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PART  B1 


TASK  ASSIGNMENT 


Panel  1 was  assigned  the  task  to  develop  a detailed  and  accurate 
chronology  of  mission  events  directly  related  to  the  flight  of  Apollo  13. 
This  event  sequence  would  then  form  a baseline  of  data  for  analytical 
use  by  Panel  1,  other  Panels,  and  the  Review  Board. 

To  provide  such  a chronology,  Panel  1 worked  to  produce  a consoli- 
dated sequence  of  all  data  whether  derived  from  telemetry  records,  crew 
observations,  inflight  photographs,  air— to— ground  communications,  or 
other  sources  of  information.  Of  special  significance  to  Panel  1 was 
the  requirement  to  correlate  data  taken  from  different  sources,  such 
as  crew  observations  and  telemetry , in  order  to  provide  greater  assur- 
ance of  the  validity  of  data  wherever  possible. 

In  order  to  provide  meaningful  boundary  conditions  for  its  work. 
Panel  1 divided  its  effort  into  three  areas: 

1.  Preincident  events,  which  covered  the  flight  from  countdown 
to  the  time  of  the  inflight  accident. 

2.  Incident  events,  which  covered  the  flight  from  approximately 
55  hours  and  52  minutes  to  the  conclusion  of  immediately  related  data 
events . 

3.  Postincident  events,  which  covered  the  subsequent  mission 
period  to  splashdown . 

In  each  of  the  three  areas  the  main  purpose  of  the  Panel  was  to 
provide  the  most  efficient  presentation  of  events  for  the  Board's  use 
in  reviewing,  evaluating,  and  interpreting  the  significance  of  mission 
events.  Consequently,  Panel  1 devoted  a considerable  portion  of  its 
time  to  the  task  of  data  interpretation  and  verification.  As  was 
intended  from  the  Charter  of  the  Board,  the  primary  focus  of  the  Panel's 
work  was  the  period  of  time  during  which  the  service  module  encountered 
serious  inflight  difficulties,  and  its  presentation  of  data  reflects 
this  particular  emphasis. 
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PART  B2 


PANEL  ORGANIZATION 


Panel  1 was  chaired  by  Mr.  Francis  B.  Smith,  Assistant  Adminis- 
trator for  University  Affairs,  NASA  Headquarters,  Washington,  D.C. 

The  Board  Monitor  was  Mr.  Neil  Armstrong  from  the  Manned  Spacecraft 
Center.  Additional  Panel  Members  were: 

Mr.  John  J.  Williams,  Kennedy  Space  Center,  for  preincident  events 

Dr.  Thomas  B.  Ballard,  Langley  Research  Center,  for  incident  events 

Mr.  M.  P.  Frank,  Manned  Spacecraft  Center,  for  postincident  events 

Although  each  of  the  above  specialized  in  one  phase  of  the  Panel's 
total  assignment,  the  Panel  acted  as  one  unit  in  the  review  and  assess- 
ment of  data  and  in  the  analysis  and  interpretation  of  those  events 
identified  with  the  accident. 
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PART  B3 


SUMMARY  OF  EVENTS 


Apollo  13  was  launched  on  schedule  from  Kennedy  Space  Center  at 
2:13:00  e.s.t.  on  April  11,  1970.  The  crew  consisted  of  James  E.  Lovell, 
Commander  (CDR);  John  L.  Swigert , Command  Module  Pilot  (CMP);  and  Fred  W. 
Haise,  Lunar  Module  Pilot  (LMP).  The  preflight  countdown  was  routine  and 
although  some  malfunctions  and  anomalies  occurred  during  boost  and  earlier 
portions  of  the  flight,  none  except  the  premature  cutoff  of  one  of  the  S-II 
engines  was  considered  at  the  time  to  he  of  a serious  nature. 

At  about  55:5^,  the  crew  had  just  completed  a television  broadcast; 

CMP  Swigert  was  in  the  left  seat  of  the  command  module,  LMP  Haise  was  in 
the  lunar  module , and  CDR  Lovell  was  in  the  CM  lower  equipment  bay , when 
all  three  heard  a loud  bang.  At  about  the  same  time  in  Mission  Control 
in  Houston,  the  Guidance  Officer  (GUIDO)  noted  on  his  console  display  that 
there  had  been  a momentary  interruption  of  the  spacecraft  computer . He 
told  the  Flight  Director,  "We've  had  a hardware  restart.  I don’t  know 
what  it  was."  At  almost  the  same  time,  CDR  Lovell,  talking  to  Mission 
Control,  said,  "I  believe  we've  had  a problem  here."  Also  at  about  the 
same  time,  the  Electrical,  Environmental,  and  Communications  Engineer 
( EECOM ) in  Mission  Control  noticed  on  his  console  display  the  sudden 
appearance  of  limit  sensing  lights  indicating  that  a few  of  the  telem- 
etered quantities  relating  to  the  spacecraft's  cryogenic,  fuel  cell,  and 
electrical  system  had  suddenly  gone  beyond  pre-set  limits.  Astronaut 
Swigert  in  the  command  module,  noting  a master  alarm  about  2 seconds 
g.f'tei'  the  bang , moved  from  the  left  seat  to  the  right  seat  where  he  could 
see  the  instruments  indicating  conditions  of  the  electrical  system,  and 
noticed  a caution  light  indicating  low  voltage  on  main  bus  B,  one  of  the 
two  busses  supplying  electrical  power  for  the  command  module.  At  that 
time,  he  reported  to  Mission  Control,  "We've  had  a problem.  We've  had 
a main  B bus  undervolt."  At  the  same  time,  however,  he  reported  the 
voltage  on  fuel  cell  3,  which  supplied  power  to  main  bus  B,  looked  good 
and  assumed  that  the  main  bus  B undervolt  condition  had  been  a transient 
one.  However,  2 or  3 minutes  later,  when  another  master  alarm  sounded, 

LMP  Haise  moved  into  the  right-hand  seat  to  recheck  the  fuel  cells  and 
noted  that  two  of  the  three  fuel  cells  (no.  1 and  no.  3)  were  showing  no 
hydrogen  or  oxygen  flow  and  no  electrical  output  and  that  fuel  cell  2 was 
carrying  the  command  module's  total  electrical  load  through  bus  A.  Bus  B 
was  dead.  In  addition,  several  other  electrical  and  cryogenic  system  ab- 
normalities were  evident. 

Detailed  studies  and  analyses  of  telemetry  records  made  since  the 
flight  indicated  that  during  the  90  seconds  before  the  "bang",  several  ab- 
normal events  occurred.  At  about  55*53:23,  within  a few  seconds  after  the 
crew  had  turned  on  two  fan  motors  which  stir  the  supercritical  cryogenic 
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oxygen  in  oxygen  tank  no.  2,  electrical  "glitches"  (transient  high- 
amplitude  current  and  voltage  fluctuations)  occurred  which  could  be  in- 
dicative of  momentary  electrical  short  circuits.  Analyses  of  telemetry 
data  also  indicate  that  first  one  fan  motor  and  then  the  other  probably 
became  disconnected  from  the  electrical  bus  concurrently  with  the  glitches. 
Thirteen  seconds  after  the  first  glitch  (l6  seconds  after  the  fans  were 
turned  on)  the  pressure  in  oxygen  tank  no.  2 started  to  rise;  during  the 
next  24  seconds  it  increased  from  a normal  value  of  891  psia  to  954  psia; 
it  remained  at  that  pressure  for  approximately  21  seconds  and  then  again 
increased  to  a maximum  value  of  1008  psia  (approximately  the  pressure  at 
which  the  relief  valve  was  set  to  open) , at  which  point  the  relief  valve 
apparently  opened  and  pressure  began  decreasing.  During  the  last  23  sec- 
onds of  this  period,  during  the  second  oxygen  pressure  increase,  telem- 
etry indicated  that  oxygen  tank  no.  2 temperature  also  began  to  increase 
sharply;  and  concurrently  with  the  sudden  temperature  rise,  the  oxygen 
tank  no.  2 quantity  gage,  which  had  been  inoperative  for  the  previous 
9 hours,  began  to  show  fluctuating  readings.  At  about  90  seconds  after 
the  start  of  the  pressure  rise,  telemetry  transmission  from  the  space- 
craft was  suddently  interrupted  for  a period  of  1.8  seconds. 

Putting  all  of  this  and  other  information  together  with  the  service 
module  photographs  taken  later  by  the  crew  and  with  subsequent  changes  in 
the  condition  of  the  spacecraft  system  leads  to  a determination  that 
immediately  before  and  during  this  1.8-second  interval  the  following 
things  happened: 

1.  The  oxygen  tank  no.  2 system  failed,  leading  to  loss  of  all 
oxygen  pressure. 

2.  The  service  module  panel  covering  bay  4 blew  off,  possibly 
producing  the  "bang"  heard  by  the  crew. 

3.  The  spacecraft’s  velocity  changed  by  0.5  fps. 

4.  Transmission  of  telemetry  from  the  spacecraft  was  interrupted 
(possibly  caused  by  the  panel  striking  and  damaging  the  high-gain  antenna 
through  which  data  were  being  telemetered) . 

5.  Various  valves  in  the  reaction  control  systems  (RCS)  were  shocked 
closed  (contributing  to  some  difficulties  in  maintaining  automatic  atti- 
tude control) . 

6.  Valves  controlling  oxygen  flow  to  fuel  cells  1 and  3 were  shocked 
closed  (leading  to  failure  of  both  fuel  cells  2-1/2  minutes  later  for  lack 
of  oxygen) . 

7.  Oxygen  tank  no.  1 started  leaking  oxygen. 


8.  Venting  of  oxygen  produced  forces  on  the  spacecraft  which  the 
automatic  stabilization  system  counteracted  by  firing  opposing  spacecraft 
reaction  control  thrusters. 

9.  Various  sensors  or  their  wiring  were  damaged  to  cause  subsequent 
erroneous  readings. 

These  changes  occurred  so  rapidly,  of  course,  that  neither  the  crew 
nor  the  mission  controllers  could  have  had  a clear  picture  of  specifi- 
cally what  had  happened. 

In  the  Mission  Control  Center,  after  the  1.8-second  data  loss,  the 
EE COM  first  suspected  an  instrumentation  failure  since  earlier  in  the 
flight  (U6:Uo)  the  oxygen  tank  no.  2 quantity  gage  had  failed  and  since 
other  pressures,  temperatures,  voltages,  and  current  readings  were  so 
abnormal  (e.g.  , more  than  100  percent  or  less  than  0 percent  of  full 
scale)  as  to  appear  unrealistic.  They  appeared  more  indicative  of  an 
instrumentation  failure  than  of  real  quantities.  The  Flight  Director 
also  initially  believed,  from  the  information  available  to  him  in  the 
Control  Center,  that  the  difficulty  was  electrical  or  electronic  in 
nature.  Consequently,  Mission  Control  Center's  initial  efforts  during 
the  first  3 or  ^ minutes  after  the  malfunction  were  to  validate  instru- 
ment readings  and  to  identify  a possible  instrumentation  failure.  Dur- 
ing the  next  several  minutes,  both  the  flightcrew  and  the  ground  con- 
trollers worked  at  switching  fuel  cell  bus  power  configurations  in  an 
attempt  to  understand  what  had  happened  and  to  get  fuel  cells  1 and  3 
back  on  line.  They  determined  that  fuel  cell  1 had  no  output  and  dis- 
connected it  from  the  bus.  Later  they  also  disconnected  fuel  cell  3 
for  the  same  reason.  For  several  minutes  they  connected  the  command 
module's  entry  battery  to  bus  A to  aid  fuel  cell  2 in  supplying  elec- 
trical power  and  to  insure  against  further  failures  due  to  low  voltage. 

Shortly  after  the  malfunction,  while  the  Apollo  13  crew  and  the 
EECOM  were  trying  unsuccessfully  to  restore  electrical  power  output  from 
fuel  cells  1 and  3,  the  Guidance  and  Navigation  Officer  (GNC)  reported 
an  unusually  high  level  of  attitude  control  thruster  activity  on  the 
spacecraft.  This  added  to  their  problems,  since  it  indicated  other 
abnormal  conditions  aboard  the  spacecraft  and  used  excessive  thruster 
fuel.  Consequently,  during  the  next  hour  the  ground  control  and  the 
crew  were  required  to  pay  a great  deal  of  attention  to  maintaining 
attitude  control  of  the  spacecraft  and  to  identifying  and  eliminating 
the  cause  of  the  instability.  At  the  same  time,  the  Flight  Director 
began  to  suspect  that  the  genesis  of  the  problem  might  lie  in  the  RCS, 
rather  than  in  the  high-gain  antenna  or  instrumentation. 


B-7 


During  this  period  (about  14  minutes  after  the  accident)  CDR  Lovell 
reported,  "...it  looks  to  me,  looking  out  the  hatch,  that  we  are  venting 

something.  We  are  venting  something  out  into  space it’s  a gas  of 

some  sort."  He  subsequently  described  this  venting  as  extremely  heavy 
and  unlike  anything  he  had  seen  in  his  three  previous  space  flights. 

For  about  1 hour  45  minutes  after  the  accident,  the  crew  and  ground 
controllers  wrestled  with  electrical  problems  caused  by  oxygen  supply 
and  fuel  cell  failures  and  with  attitude  stability  problems  caused  by 
the  venting  of  oxygen,  the  shock  closing  of  thruster  system  valves,  and 
electrical  system  failures.  During  this  period  they  went  through  a 
series  of  control  system  reconfigurations  until  automatic  control 
was  finally  established  at  57:32.  In  the  meantime,  as  it  became  more 
apparent  that  the  loss  of  oxygen  from  oxygen  tank  no.  1 could  not  be 
stopped  and  that  fuel  cell  2 would  soon  expire,  the  LM  was  powered  up 
(57:40),  LM  telemetry  was  turned  on  (57:57)  and  attitude  control  was 
transferred  from  the  CM  to  the  LM  (58:34).  At  58: 40,  2 hours  45  minutes 
after  the  accident,  the  CM  was  completely  powered  down. 

One  of  the  main  concerns  then  was  to  make  the  trajectory  changes 
that  would  return  the  spacecraft  safely  to  Earth  within  the  lifetime 
of  the  onboard  consumables--water , oxygen,  thruster  fuel,  and  electric 
power.  At  the  time  of  the  accident  the  spacecraft  was  on  a trajectory 
which  would  have  swung  it  around  the  Moon  (about  21  hours  after  the  ac- 
cident) and  returned  it  to  Earth  where  it  would  have  been  left  in  a 
highly  elliptical  orbit  about  the  Earth  with  a perigee  (nearest  approach 
to  Earth)  of  about  2400  miles.  Four  trajectory  correction  burns  were 
made  during  the  remainder  of  the  flight  as  illustrated  in  figure  B6-9. 

: 30  - A 58  fps  incremental  velocity  (delta  V)  burn  using  the 
descent  propulsion  system  (DPS)  engine  and  the  LM  primary  guidance  and 
navigation  system  (PGNS).  This  burn  was  performed  16  hours  before  they 
swung  around  the  Moon,  and  was  targeted  to  place  the  spacecraft  on  a 
traje-ctory  which  would  return  it  to  the  atmospheric  Earth  reentry  corri- 
dor rather  than  the  2400-mile  perigee . 

79:28  - A 86l  fps  delta  V burn  using  the  DPS  2 hours  after  swinging 
around  the  Moon  to  speed  up  return  to  Earth  by  about  9 hours  (l43  versus 
152  g.e.t.)  and  to  move  the  landing  point  from  the  Indian  Ocean  to  the 
Pacific  Ocean  where  the  primary  recovery  forces  were  located. 

j-22 : - A 7.8  fps  delta  V burn  using  DPS  to  lower  perigee  altitude 
from  87  miles  to  about  21  miles. 

!37 :4o  - A 3.2  fps  delta  V final  burn  using  LM  RCS  thruster  to  cor- 
rect for  small  dispersions  in  previous  burns  and  assure  that  the  space- 
craft would  reenter  in  the  center  of  its  entry  corridor. 
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During  the  remainder  of  the  flight  there  were  several  other  unusual 
situations  which  the  crew  and  Mission  Control  successfully  contended  with. 
The  use  of  electrical  power  aboard  the  LM  had  to  he  managed  very  carefully 
to  conserve  not  only  the  LM  batteries  but  also  the  water  supply,  since 
water  was  used  to  dissipate  heat  generated  by  the  electrical  equipment. 

The  LM  LiOH  was  not  adequate  to  remove  carbon  dioxide  for  three  men  for 
the  duration  of  the  return  trip,  so  a method  was  devised  to  circulate 
the  LM  cabin  oxygen  through  the  CM's  LiOH  filters.  Since  the  CM  had  to 
be  used  for  reentry,  its  main  bus  B had  to  be  checked  out  very  carefully 
to  assure  that  there  were  no  electrical  shorts  and  the  CM  entry  battery 
which  had  been  used  earlier  to  supply  power  for  the  ailing  CM  had  to  be 
recharged  from  the  LM  batteries . 

Several  actions  essential  to  reentry  and  landing  were  undertaken 
during  the  last  9 hours  of  the  flight  as  illustrated  in  figure  B6-10. 

The  SM  was  jettisoned  a few  minutes  after  the  last  midcourse  correction, 
about  U-l/2  hours  before  reentry.  In  viewing  and  photographing  the  SM, 
the  crew  realized  for  the  first  time  the  extensiveness  of  the  physical 
damage  (panel  blown  off,  Mylar  strips  hanging  from  antenna,  etc.).  At 
about  2-1/2  hours  before  reentry,  the  CM's  inertial  platform  was  powered 
up  and  aligned  and  the  LM  was  jettisoned  about  1/2  hour  later.  Reentry 
was  at  l42:U0  and  splashdown  at  1^2:5*+  g.e.t. 
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PART  BU 


PRELAUNCH  AND  MISSION  EVENTS  PRIOR  TO  THE  ACCIDENT 


This  section  of  the  report  contains  significant  events  prior  to 
the  accident  with  emphasis  placed  on  the  spacecraft  and  particularly 
on  the  cryogenic  system.  It  starts  with  the  launch  count  (T  - 98:00:00) 
and  ends  prior  to  the  significant  events  of  the  accident  (55:52:00). 


LAUNCH  COUNTDOWN 


Countdown  operations  for  both  the  command  service  module  (CSM) 
and  lunar  module  (LM)  were  started  at  approximately  10:00  a.m.  e.s.t. 
on  Monday,  April  6,  1970.  The  start  of  the  countdown  was  delayed 
approximately  8 hours  because  of  a pad  clear  operation  involving  a 
special  test  of  the  LM  supercritical  helium  (SHe)  system.  A timeline 
of  significant  countdown  milestones  is  shown  in  figure  BU-l. 


Mechanical  Build-up  and  Gas  Servicing 

Following  completion  of  CSM  powerup,  water  servicing,  and  securing 
of  the  LM  SHe  operation,  installation  of  the  CSM  heavy  ordnance  initi- 
ators was  started  at  approximately  3:00  p.m.  e.s.t.  The  ordnance 
operation  and  remote  resistance  checks  of  the  launch  escape  rocket 
initiators  were  completed  by  9:30  p.m.  e.s.t.,  April  6,  after  being 
slightly  delayed  to  correct  a mechanical  interference  problem  (incorrect 
thread  depth)  with  the  initiator  in  the  launch  escape  rocket  motor. 
Combined  CSM  and  LM  helium  and  gaseous  oxygen  ( GOX)  servicing  was 
started  at  2:00  a.m.  e.s.t.  on  April  7,  and  was  successfully  completed 
by  noon  that  day.  At  this  time,  both  the  CSM  and  LM  were  functional 
at  T - 66:00:00,  at  which  point  a built-in  hold  of  12  hours  had  been 
originally  planned.  As  a result  of  the  late  countdown  start,  both  the 
LM  and  CSM  spacecrafts  experienced  only  a 6-hour  built-in  hold. 

From  noon  Tuesday,  April  7,  through  11:00  a.m.  Thursday,  April  9, 
mechanical  build-up  operations  (panel  closure,  LM  thermal  blanket  in- 
stallation, etc.)  were  conducted  on  the  CSM  and  LM.  The  CSM  fuel  cells 
were  activated  and  preparations  were  completed  for  CSM  cryo  loading, 
that  is,  filling  the  cryogenic  oxygen  and  hydrogen  tanks.  Details  of 
this  operation  are  covered  below.  During  this  time  the  LM  SHe  tank  was 
initially  loaded  and  a 2l4-hour  cold  soak  period  started.  All  of  these 
operations  were  completed  without  a significant  problem,  with  the 
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Figure  b4-1.-  Planned  launch  countdown  timeline 


spacecraft  progressing  functionally  from  T - 66:00:00  to  T - 41:00:00; 
including  completion  of  the  built-in  hold  at  T - 66:00:00  and  another 
planned  l6-hour  built-in  hold  at  T - 48:00:00. 


Cryogenic  Servicing 

CSM  cryo  loading  or  flowing  liquid  hydrogen  and  liquid  oxygen  was 
scheduled  to  be  performed  from  11:00  a.m.  e.s.t.  through  7:00  p.m.  e.s.t. 
Thursday,  April  9,  1970.  A timeline  of  significant  milestones , including 
preliminary  preparations,  is  shown  in  figure  B4-2.  (See  Appendix  A, 

Part  A5  for  a description  of  the  fuel  cell  and  cryogenic  systems.)  The 
configuration  of  the  cryogenic  and  fuel  cell  systems  was  as  follows: 

1.  The  fuel  cell  gaseous  oxygen  and  hydrogen  systems  were  at  a 
pressure  of  28  psia  with  oxygen  and  hydrogen  gases.  The  fuel  cells  had 
been  operated  in  the  countdown  demonstration  test  (CDDT)  and  were  left 
pressurized  with  reactant  gases  (gaseous  oxygen  and  hydrogen)  to  main- 
tain system  integrity  between  CDDT  and  countdown. 

2.  The  oxygen  and  hydrogen  tanks  were  at  a pressure  of  80  psia 
with  oxygen  and  hydrogen  gases.  The  tanks  had  been  evacuated  (less  than 
5mm  Hg  for  2 hours  minimum)  and  serviced  during  CDDT , with  reactant  gas 
left  in  the  system  after  detanking  to  maintain  system  integrity  between 
CDDT  and  countdown. 

3.  The  ground  support  equipment  (GSE)  lines  were  connected  to  the 
spacecraft  and  had  been  previously  evacuated,  pulse  purged,  and  then 
pressurized  with  reactant  gas  to  80  psia.  Purity  samples  taken  of  the 
gases  from  the  GSE  were  within  specification.  The  pressure-operated 
disconnects  (POD's)  that  connect  the  GSE  to  the  spacecraft  had  been  leak 
checked  at  80  psia  with  reactant  gas  and  indicated  no  leakage. 

4.  The  portable  oxygen  dewar  used  to  service  the  spacecraft  oxygen 
tanks  was  serviced  on  April  7,  1970-  Liquid  samples  taken  from  the  vent 
line  of  the  dewar  during  servicing  were  within  specification.  All  of  the 
preceding  activities  were  accomplished  without  undue  delay  or  difficulty. 

The  first  activity  for  the  fuel  cell  and  cryogenic  system  in  the 
countdown  started  at  approximately  3:00  p.m.  e.s.t.  on  April  8,  1970. 

The  move  of  the  liquid  hydrogen  and  liquid  oxygen  dewars  from  the  cryo- 
genic buildings  to  the  pad  had  been  completed.  The  primary  oxygen, 
backup  oxygen,  and  backup  hydrogen  dewars  were  located  on  the  pad  at  the 
base  of  the  mobile  service  structure  (MSS)  while  the  primary  hydrogen 
dewar  was  moved  to  level  4A  of  the  MSS.  The  hydrogen  and  oxygen  GSE 
configuration  is  shown  in  figures  b4-3  and  B4-4,  respectively. 
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Figure  Hydrogen  servicing  configuration 
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Purge  line 

Figure  B4-4.-  Oxygen  servicing  configuration. 


Pictures  of  the  servicing  dewars,  valve  boxes,  and  pressurizing  equipment 
are  shown  in  figures  B4-5  through  B4-10. 

Dewpoint  samples  of  the  oxygen  and  hydrogen  spacecraft  tanks  were 
obtained.  This  was  accomplished  by  pressurizing  the  tanks  with  reactant 
gas  to  80  psia  through  the  vent  line  and  then  venting  the  tank  back 
through  the  vent  line  and  obtaining  a moisture  sample  at  the  vent  line 
sample  valve.  Both  the  oxygen  and  hydrogen  tanks  met  the  requirements 
that  the  moisture  content  be  less  than  25  parts  per  million  (ppm). 

Oxygen  tanks  no.  1 and  no.  2 read  less  than  2 ppm. 

After  the  dewpoint  samples  of  the  tanks  were  obtained,  sample  bot- 
tles were  installed  on  the  tank  vent  lines.  The  sample  bottles  were 
flow  purged  with  reactant  gases  at  80  psia  for  5 minutes,  followed  by 
10  pulse  purges  ranging  in  pressure  from  80  psia  to  20  psia. 

The  hydrogen  dewar  was  then  connected  to  the  servicing  GSE.  The 
fill  line  between  the  dewar  and  the  spacecraft  was  flow  purged  with 
55  psia  of  helium  gas  for  15  minutes,  and  a moisture  sample  taken  from 
the  fill  line.  A sample  result  of  2 ppm  was  obtained.  An  additional 
flow  purge  using  gaseous  hydrogen  at  55  psia  was  then  performed  for 
10  minutes,  followed  by  13  pulse  purges  ranging  in  pressure  from  55  psia 
to  20  psia  (Note:  This  cleans  the  dead-end  areas  at  the  manifold). 

The  fuel  cells  were  then  pressurized  to  their  operating  pressure 
(62  psia  oxygen  and  hydrogen) . Heat  was  applied  electrically  to  the 
fuel  cells  from  external  GSE  to  melt  the  potassium  hydroxide.  Fuel 
cell  3 heater  current,  supplied  from  GSE  for  heatup,  was  slightly  low 
(1.2  amps  vs.  1.4  amps).  This  heater  current  was  adjusted  after  the 
heatup  and  calibration  of  the  fuel  cells  was  completed. 

With  the  fuel  cells  at  operating  temperature  (420°  F)  and  pressures, 
a calibration  test  on  each  fuel  cell  was  performed.  Fuel  cells  were 
calibrated  by  applying  loads  in  approximately  10-amp  increments  until  a 
maximum  current  of  60  amps  was  reached  while  monitoring  the  output  volt- 
age. The  fuel  cell  loads  were  supplied  by  GSE  load  banks.  After  cali- 
bration, the  fuel  cells  were  connected  to  the  spacecraft  busses  and 
40-amp  GSE  load  applied  to  each  cell  for  fuel  cell  water  conditioning 
(approximately  4 hours).  After  these  loads  were  removed  from  each  fuel 
cell,  6-amp  in-line  heater  loads  with  a 50-percent  duty  cycle  were  ap- 
plied. With  the  fuel  cells  in  this  configuration  a visual  engineering 
inspection  of  the  liquid  hydrogen  and  liquid  oxygen  loading  systems  was 
performed  with  the  exception  of  the  liquid  oxygen  dewar,  not  yet  con- 
nected. 

Immediately  prior  to  flowing  liquid  hydrogen,  the  spacecraft  hy- 
drogen and  oxygen  tank  fans  and  quantity  probe  circuit  breakers  were 


B-17 


Figure  B4-5.-  Liquid  hydrogen  dewar. 
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Figure  B4-6.-  Liquid  oxygen  dewar. 
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Figure  B4-7.-  Hydrogen  valve  box  at  Launch  Complex  39- 
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Figure  b4-8.-  Oxygen  valve  box  at  Launch  Complex  59- 
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Figure  BU-9.-  Hydrogen  transfer  unit  at  Launch  Complex  39. 
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Figure  B4-10.-  Oxygen  transfer  unit  at  Launch  Complex  59 


closed.  (See  Appendix  A,  Part  A5,  for  description  of  the  oxygen  and 
hydrogen  tanks.)  The  hydrogen  dewar  was  pressurized  to  approximately 
30  psia  prior  to  servicing.  Hydrogen  was  flowed  through  both  tanks  for 
10  minutes  (normal)  prior  to  obtaining  an  increase  in  tank  quantity. 

This  period  is  required  to  chill  the  system.  The  flow  rate  during 
servicing  was  approximately  2.1  pounds  per  minute  for  22  minutes  (both 
tanks).  The  flow  was  stopped  for  30  minutes  when  the  tank  quantity 
reached  85-percent  and  the  dewar  and  spacecraft  tanks  vented  to  ambient 
pressure.  The  fans  were  turned  off  during  this  period.  This  time 
period  is  required  to  chill  the  hydrogen  tank.  The  dewar  was  again 
pressurized  to  approximately  30  psia,  and  flow  (at  normal  rates)  began 
through  the  fill  manifold  detank  line  for  2 minutes  to  chill  the  GSE 
prior  to  then  opening  the  spacecraft  fill  POD's.  When  the  quantity  gage 
stabilized  (about  98-percent)  the  dewar  pressure  was  increased  to  approx- 
imately 35  psia  and  the  vent  POD's  closed,  followed  closely  by  the 
closure  of  the  fill  POD's.  The  GSE  vent  valve  was  closed  simultaneously 
with  the  closing  of  the  spacecraft  vent  POD's.  This  operation  traps 
cold  gas  between  the  spacecraft  vent  POD's  and  the  GSE  vent  valve.  As 
the  cold  gas  warms  and  expands,  it  is  vented  into  the  two  sample  con- 
tainers connected  to  the  vent  line  sample  valve.  The  samples  were 
analyzed  for  helium,  nitrogen,  and  total  hydrocarbons.  Both  samples 
were  within  specifications. 

The  hydrogen  dewar  was  removed  and  the  prime  oxygen  dewar  was 
brought  up  to  level  4A  of  the  MSS.  The  oxygen  dewar  was  connected  to 
the  servicing  GSE.  The  fill  line  between  the  dewar  and  the  spacecraft 
was  flow  purged  with  55  psia  of  oxygen  gas  for  15  minutes,  and  a mois- 
ture sample  taken  from  the  fill  line.  A sample  result  of  less  than  2 ppm 
was  obtained.  After  sampling,  13  pulse  purges  from  a pressure  of  55  psia 
to  a slight  positive  pressure  to  maintain  flow  were  performed.  The 
spacecraft  oxygen  tank  fans  were  turned  on  prior  to  oxygen  flow.  The 
oxygen  dewar  was  pressurized  to  approximately  45  psia.  Oxygen  was  flowed 
through  both  tanks  for  approximately  2 minutes  (normal)  before  an  indica- 
tion was  noted  on  the  quantity  probe.  The  flow  rate  during  servicing  was 
25  pounds  per  minute  for  approximately  25  minutes  (both  tanks).  After 
the  tank  quantity  reached  100  percent,  flow  was  continued  for  an  ad- 
ditional 10  minutes,  to  further  chill  the  tanks.  The  spacecraft  vent 
POD’s  and  the  GSE  vent  were  then  closed,  followed  immediately  by  the 
closure  of  the  fill  POD's.  The  spacecraft  tank  fans  were  turned  off  at 
this  time.  The  cold  gas  trapped  in  the  vent  line  was  sampled.  The 
oxygen  is  sampled  for  helium,  nitrogen,  and  total  hydrocarbons.  Both 
samples  were  within  specification.  The  service  module  supply  valve  was 
opened  to  allow  the  CM  surge  tank  to  pressurize  for  flight. 

While  pressurizing  the  surge  tank,  fuel  cell  1 was  connected 
to  dc  bus  A to  minimize  the  usage  of  liquid  hydrogen.  A constant 
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flow  from  the  liquid  hydrogen  tanks  equal  to  the  heat  gained  by  the  tank 
results  in  minimum  liquid  hydrogen  usage.  The  load  on  the  fuel  cell  was 
approximately  20  amps.  This  configuration  was  maintained  until  4 hours 
before  launch,  at  which  time  fuel  cells  2 and  3 were  connected  to  the 
busses.  Fuel  cells  1 and  2 were  connected  to  bus  A with  fuel  cell  3 
supplying  power  to  bus  B.  The  fuel  cells  supplied  power  to  the  space- 
craft from  this  time  through  launch. 

Ground  electrical  power  was  supplied  to  the  tank  heaters  to  bring 
the  tanks  to  flight  pressure.  The  liquid  oxygen  system  pressurization 
to  approximately  935  psia  and  the  liquid  hydrogen  system  to  approximately 
235  psia  was  completed  by  6:40  p.m.  on  April  9?  1970.  The  fuel  cells 
were  supplied  by  onboard  reactants  from  this  period  through  launch.  Fan 
motor  checks  were  performed,  and  the  GSE  and  airborne  systems  closed  out 
for  flight. 

The  entire  CSM  cryo  loading  operation  was  normal  except  that  liquid 
hydrogen  tank  no.  1 was  loaded  to  98.7  percent  instead  of  the  desired 
minimum  99  percent  (reason  for  this  is  still  under  study  by  both  the 
Manned  Spacecraft  Center  and  the  Kennedy  Space  Center)  and  a slight  leak 
developed  through  the  liquid  oxygen  tank  no.  2 vent  quick  disconnect. 

The  leak  was  stopped  by  the  installation  of  the  flight  cap  prior  to  tank 
pressurization.  These  conditions  were  determined  to  be  acceptable  for 
flight. 


Spacecraft  Closeout  and  Terminal  Count  * 

Following  completion  of  the  cryo  loading  operation  the  countdown 
proceeded  normally  from  T - 32:00:00  through  such  milestones  as:  LM  crew 
provision  stowage  and  final  closeout;  LM  SHe  servicing;  launch  vehicle 
battery  installation  and  electrical  systems  checks;  CSM  crew  provision 
stowage;  backup  astronaut  crew  checks;  and  ALSEP  fuel  cask  installation. 

At  7:00  p.m.  e.s.t.  on  April  10,  1970,  the  countdown  clock  was  held 
at  T - 9:00:00  for  a planned  built-in  hold  of  9 hours  and  13  minutes. 

Following  resumption  of  the  countdown  at  4:13  a.m.  e.s.t.  on  April  11, 

1970,  final  launch  vehicle  cryogenic  loading  preparations  were  completed 
and  launch  vehicle  cryogenic  loading  was  successfully  conducted  through 
9:30  a.m.  e.s.t. 

The  remainder  of  the  countdown  activities,  including  flightcrew 
ingress,  final  CSM  cabin  closeout,  and  the  space  vehicle  terminal  count, 
progressed  normally  with  the  exception  of  a minor  problem  with  a broken 
key  in  the  CSM  pyro  guard,  and  a stuck  open  no.  2 liquid  oxygen  vent 
valve  in  the  S-IC  stage.  Both  problems  were  satisfactorily  resolved  with- 
in the  planned  countdown  time,  which  included  a final  built-in  hold  of 
1 hour  at  T - 3 t 30: 00  minutes. 
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LAUNCH  AND  TRANSLUNAR  COAST  PHASE  PRIOR  TO  THE  ACCIDENT 


Launch  and  Flight  Summary 

The  space  vehicle  was  launched  at  2:13:00  e.s.t.,  April  11,  1970. 
The  only  unexpected  occurrence  during  the  boost  phase  was  an  early 
shutdown  of  the  S-II  inboard  engine.  Low  frequency  oscillations 
(approximately  l6  hertz)  occurred  on  the  S-II  stage,  resulting  in  a 
132-second  premature  center  engine  cutoff.  Preliminary  analysis  indi- 
cates that  an  engine  pressure  sensor  detected  a varying  engine  thrust 
chamber  pressure  resulting  from  a large  pressure  oscillation  in  the 
liquid  oxygen  system  and  turned  the  engine  off.  The  four  remaining 
engines  burned  approximately  31*  seconds  longer  than  normal,  and  the 
S-IVB  orbital  insertion  burn  was  approximately  9 seconds  longer  to 
achieve  the  required  velocity.  The  cause  of  the  liquid  oxygen  system 
oscillation  is  presently  being  studied  by  the  Marshall  Space  Flight 
Center.  A parking  orbit  with  an  apogee  of  100.2  nautical  miles  and  a 
perigee  of  98.0  nautical  miles  was  obtained. 

After  orbital  insertion,  all  launch  vehicle  and  spacecraft  systems 
were  verified  and  preparations  were  made  for  translunar  injection.  The 
second  S-IVB  burn  was  initiated  on  schedule  for  translunar  injection. 

All  major  systems  operated  satisfactorily  and  conditions  were 
nominal  for  a free-return  circumlunar  trajectory.  With  the  spacecraft 
in  a free-return  trajectory,  and  with  no  further  major  propulsion 
burns , the  spacecraft  would  pass  around  the  Moon  and  reenter  the 
Earth's  atmosphere. 

The  command  service  module  (CSM)  separated  from  the  service  module 
LM  adapter  (SLA)  at  3:06:39.  The  spacecraft  was  maneuvered  and  docked 
with  the  lunar  module  (LM)  at  3:19:09  and  the  LM  separated  from  the 
SLA  at  0^:01:00.  The  S— IVB  was  then  maneuvered  using  residual  pro- 
pellants to  impact  the  lunar  surface.  The  first  midcourse  correction 
(23.1  fps ) , performed  at  30:UO:50  using  the  service  propulsion  system, 
inserted  the  spacecraft  into  a non-free-return  trajectory  with  a peri- 
cynthian  altitude  close  to  the  planned  value  of  about  60  miles.  Under 
these  conditions,  with  no  further  propulsion  engine  burns,  the  spacecraft 
would  orbit  the  Earth  in  a highly  elliptical  orbit.  These  trajectories 
are  discussed  in  more  detail  in  Part  B6  of  this  Appendix. 

The  mission  was  routine  and  generally  proceeded  according  to  the 
timeline.  Because  the  crew  was  ahead  of  schedule  and  midcourse  cor- 
rection n limber  3 was  cancelled,  an  early  entry  into  the  lunar  module 
was  made  at  55:00:00.  A scheduled  television  broadcast  to  the  Earth 
was  made  between  55:15  and  55:^6,  and  at  the  time  of  the  accident. 
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both  the  Commander  and  Command  Module  Pilot  were  in  the  command  module 
while  the  Lunar  Module  Pilot  was  just  entering  the  command  module  from 
the  lunar  module. 


Spacecraft  Systems  Operation 

This  section  of  the  report  will  deal  only  with  problems  and  events 
in  the  various  systems  encountered  with  the  CSM  during  the  powered 
phase,  parking  orbit,  and  translunar  coast  phase  of  the  mission  up  to 
the  time  of  the  accident.  The  systems  will  be  treated  separately 
except  that  electrical  current  and  voltage  fluctuations  associated  with 
the  operation  of  the  fans  to  stir  the  supercritical  oxygen  and  hydrogen 
will  be  covered  under  the  cryogenic  section. 

CSM  structural-mechanical.-  Structural  loads  during  boost  phases 
of  the  flight  were  within  acceptable  limits.  Command  module  structural 
oscillations  of  less  than  0 . lg  at  1 6 hertz  in  all  directions  were 
measured  during  the  period  of  S-II  longitudinal  oscillations  (POGO) 
prior  to  the  center  engine  cutoff.  The  levels  of  these  oscillations 
were  comparable  to  those  measured  during  ground  test  and  on  previous 
Apollo  missions. 

At  approximately  00:25:00  minutes,  a computer  program  was  entered 
into  the  computer  to  align  the  inertial  measuring  unit.  During  this 
alignment,  the  sextant  is  rotated,  which  in  turn  releases  the  external 
ablative  optics  covers.  The  optics  covers  are  spring  loaded,  and  held 
in  place  by  clips.  When  the  sextant  is  rotated,  an  arm  located  on  the 
sextant  engages  a cam  that  releases  the  clips  and  jettisons  both  covers. 
Minor  difficulty  was  experienced  in  jettisoning  the  two  covers.  The 
optics  were  rotated  twice  manually  to  90  degrees  according  to  the 
checklist,  but  the  covers  did  not  jettison.  The  optics  were  then 
rotated  in  the  automatic  mode  (past  90  degrees)  and  the  covers  jetti- 
soned. The  cause  of  the  covers  not  jettisoning  was  that  the  sextant 
was  not  rotated  far  enough  in  the  manual  mode  to  completely  engage  the 
cam. 


After  CSM/LM  docking,  the  crew  reported  that  two  docking  latches 
were  not  fully  engaged.  Both  latches  were  opened  and  reset.  There 
are  12  docking  latches  on  the  command  module.  Each  latch  has  a trigger 
that  is  engaged  when  the  lunar  module  docking  ring  comes  in  contact 
with  the  CSM  docking  ring.  The  handle  has  a red  indicator  that  indi- 
cates when  the  latch  is  engaged.  On  several  spacecraft  during  ground 
checkout  one  or  two  of  the  latches  had  to  be  reset  manually,  as  in  the 
case  of  Apollo  13.  The  prime  cause  is  not  having  the  two  docking  rings 
perfectly  parallel  at  the  time  of  engagement.  The  manual  resetting  of 
one  or  two  of  the  latches  is  considered  satisfactory. 
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The  crew  reported  a slight  "burnt"  smell  in  the  tunnel  area  between 
the  CSM/LM  when  entering  the  tunnel,  which  is  normal. 

Electrical  power.-  The  electrical  power  distribution  and  sequen- 
tial system,  except  for  the  fuel  cells,  operated  as  expected  until  the 
time  of  the  accident.  The  electrical  parameters  associated  with  the 
fan  turnon  and  turnoff  times  will  be  discussed  in  Part  B9. 

At  about  30:^5:00  the  fuel  cell  3 condenser  exit  temperature 
pattern  was  observed  to  change  to  a sinusoidal  ripple  with  a frequency 
of  1 cycle  every  30  seconds  and  a peak-to-peak  amplitude  of  6.2°  F. 

The  oscillations  continued  for  approximately  9 hours  and  then  stopped. 
Similar  oscillations  had  been  observed  on  Apollo  10  during  lunar  orbit, 
and  subsequent  analyses  and  tests  showed  that  the  oscillations  were  not 
detrimental  to  the  performance  or  life  of  the  fuel  cells.  These  tran- 
sients are  attributed  to  slugs  of  cold  water  leaving  the  condenser. 

Instrumentation . - Four  discrepancies  in  the  instrumentation  sys- 
tem were  noted.  At  i+6:^0:06  the  oxygen  quantity  measurement  located 
in  oxygen  tank  no.  2 indicated  100  percent.  This  anomaly  will  be 
discussed  in  detail  in  Part  B9-  The  cabin  pressure  indicated  1/2  psi 
above  the  suit  pressure  until  powerdown  of  the  CSM  after  the  incident. 
(Should  be  approximately  the  same  with  the  crew  out  of  the  suits.) 

During  the  boost  phase,  when  the  cabin  vented  the  transducer  did  not 
follow  the  cabin  pressure  and  operated  erratically  for  the  remainder 
of  the  flight.  This  erratic  operation  was  very  similar  to  the  erratic 
operation  of  the  identical  transducer  on  Apollo  12.  Failure  analysis 
of  the  Apollo  12  transducer  indicated  contamination  inside  the 
transducer . 

Early  in  the  mission  (22:38  and  37*38)  the  potable  water  quantity 
transducer  acted  erratically  for  a brief  period.  This  instrument  has 
operated  erratically  on  other  spacecraft  during  ground  checkout  and 
flight  due  to  oxidation  of  electrical  winding  on  the  transducer  poten- 
tiometer. This  oxidation  causes  intermittent  contact  between  the 
wiper  arm  and  the  wiring  on  the  potentiometer,  thus  giving  erratic 
readings . 

At  approximately  T + 32  hours,  the  crew  reported  that  the  space- 
craft panel  meters  indicating  fuel  cell  hydrogen  versus  oxygen  flow 
were  not  exactly  matched  for  fuel  cell  3.  All  Indications  on  the 
ground  were  normal.  Prelaunch  ground  data  once  indicated  a mismatch 
In  panel  indication  on  fuel  cell  2.  Since  the  instrumentation  data 
in  both  cases  were  correct,  the  most  probable  cause  was  an  inter- 
mittent fault  in  the  meter  circuitry  causing  the  shift. 
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Communications . - At  55:05:32  the  crew  reported  that  they  could  not 
operate  the  high-gain  antenna  (HGA)  in  narrow  beamwidth  auto  track  or 
reacquisition  modes.  A maneuver  to  the  passive  thermal  control  (PTC) 
attitude  was  prescribed  and  as  the  maneuver  was  initiated,  the  crew 
manually  positioned  the  antenna  and  acquired  automatic  tracking  in 
the  narrow  beamwidth  mode.  The  antenna  operated  normally  until  the 
accident.  When  troubleshooting  (before  lockup)  both  the  primary  and 
secondary  electronics  and  both  the  automatic  and  reacquisition  tracking 
modes  were  unsuccessfully  attempted.  Analysis  indicates  an  effective 
misalignment  existed  between  the  boresight  of  the  wide  and  narrow 
beams . The  beam  effective  misalignment  could  have  been  caused  by  a 
defective  radio  frequency  (RF)  stripline  coaxial  cable,  mechanical 
failure,  or  RF  feed  lines.  A boresight  shift  was  not  indicated  during 
antenna  acceptance  testing  or  during  KSC  ground  checkout. 

Service  module  propulsion  and  reaction  control.-  The  service 
module  propulsion  system  was  used  only  once  during  the  mission  at 
30:40:50  to  place  the  spacecraft  into  a non-free-return  trajectory. 

The  engine  burned  for  3.6  seconds,  and  all  parameters  were  nominal. 

The  thrust  chamber  pressure  seemed  about  4 percent  below  preflight 
prediction,  but  within  acceptable  limits. 

Guidance  and  control.-  Guidance  and  control  system  performance  was 
satisfactory,  with  the  exception  of  small  fluctuations  of  the  optic 
shaft  when  in  the  zero  optics  mode  and  in  establishing  passive  thermal 
control  (PTC).  At  approximately  7:30:00  the  crew  reported  difficulty 
in  establishing  PTC.  The  attempt  resulted  in  a very  wide  and  diverging 
coning  angle.  It  was  determined  that  the  digital  autopilot  was  in- 
correctly loaded  and  all  roll  thrusters  were  not  enabled.  The  checklist 
did  not  call  out  the  correct  autopilot  load  and  the  thruster  enabling 
was  a late  pen-and-ink  change  to  the  onboard  checklist.  Using  the 
revised  procedure,  the  PTC  mode  was  successfuly  established. 

At  about  40:00  the  ground  controllers  noticed  small  fluctuations 
of  the  optic  shaft  when  in  zero  optics  mode.  As  on  Apollo  12,  the 
ground  data  showed  a slight  jitter  in  the  optics  shaft  angle  from 
0 to  0.6  degree.  A special  test  was  conducted  at  49  hours  to  verify 
the  shaft  oscillations.  The  crew  compared  the  shaft  and  trunnion 
angles  to  the  mechanical  counters  on  the  optics.  The  oscillation  was 
evident  from  both  sources  and  occurred  in  the  optics  zero  mode  only. 

The  optics  jitter  presented  no  constraint  to  the  operation  of  the 
optical  system;  however,  at  49:51:37  the  ground  requested  the  crew  to 
turn  off  optics  power  to  guard  against  possible  degradation  of  the 
system. 
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Environmental  control.-  No  anomalies  were  noted  in  the  environmental 
control  system  operation . 

Thermal  control.-  The  thermal  control  system  of  the  CSM  performed 
normally  until  the  incident. 

Cryogenic  system.-  Both  the  liquid  hydrogen  and  the  liquid  oxygen 
systems  operated  satisfactorily  up  to  the  time  of  the  accident  as  far 
as  the  fuel  cells  and  environmental  control  systems  were  concerned. 
Because  of  the  unbalance  in  hydrogen  quantities  during  loading,  and 
unequal  usage  during  launch  pad  operation,  several  hydrogen  low-pressure 
master  alarms  were  detected  on  the  caution  and  warning  system.  (A 
description  of  the  caution  and  warning  system  is  contained  in  Appendix  A, 
Part  A2.10.)  At  46:40:08  the  oxygen  tank  no.  2 quantity  measurement 
indicated  100  percent  quantity  and  remained  at  this  value  until  the 
pressure  rise  at  55:53:35-  With  the  exception  of  the  above,  system 
operations  were  normal  to  the  time  of  the  accident. 

The  following  sections  will  describe  the  low  hydrogen  pressure 
master  alarm  and  supercritical  liquid  hydrogen  and  oxygen  destratifica— 
tion  up  to  the  time  of  the  accident . 


Hydrogen  Low  Pressure  Master  Alarm 

The  caution  and  warning  system,  upon  receipt  of  a malfunction  or 
out- of- tolerance  signal,  simultaneously  identifies  the  abnormal  condi- 
tion and  alerts  the  crew  to  its  existence.  Each  signal  (both  oxygen 
and  hydrogen  pressure  are  on  one  indicator)  will  activate  the  system 
status  indicator,  light  the  master  alarm  light,  and  place  an  audio  tone 
in  the  crew's  headsets.  The  crew  can  turn  off  or  reset  the  master 
alarm;  however,  the  particular  system  status  malfunction  indicators 
remain  lit,  blocking  further  master  alarms  on  this  indication,  until 
the  malfunction  is  cleared. 

At  lift-off,  the  quantity  readings  for  the  hydrogen  tanks  no.  1 
and  no.  2 were  91  percent  and  93.4  percent,  respectively.  This  was  due 
to  initial  loading  values  (98.7  percent  for  tank  no.  1 and  99.4  percent 
for  tank  no.  2)  and  the  difference  in  usage  during  countdown. 

At  approximately  32:00  g.e.t.,  a quantity  unbalance  of  2.38  percent 
existed  between  the  hydrogen  tanks,  and  a quantity  balancing  procedure 
was  conducted  to  prevent  tank  no.  1 low-pressure  master  alarms  during 
the  sleep  period.  In  the  "auto"  mode  the  tank  heaters  are  turned  on  and 
off  pressure  switches  connected  in  series.  When  the  pressure  in 
either  tank  reaches  about  260  psi,  the  heaters  in  both  tanks  are  switched 
off.  The  heaters  remain  off  until  the  opened  pressure  switch  closes  at 
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approximately  225  psi.  Since  one  tank  pressure  switch  normally  remains 
closed,  the  tank  that  controls  the  upper  pressure  will  also  control  at 
the  lower  pressure.  During  the  flight,  tank  no.  2 was  controlling. 

Tank  no.  1 pressure  was  almost  reaching  the  caution  and  warning  low 
pressure  point  (224.2  psia)  prior  to  tank  no.  2 reaching  its  pressure 
switch  activation  point  of  253-6  psia  to  turn  on  the  heaters. 

Since  tank  no.  2 had  the  greater  quantity,  at  32:00  the  tank  no.  1 
heaters  were  iranually  turned  off  by  the  crew  while  tank  no.  2 remained 
in  auto.  This  condition  would  allow  the  fuel  cells  to  obtain  hydrogen 
from  tank  no.  2 because  of  its  higher  pressure  and  in  turn  reduce  its 
quantity  of  hydrogen.  Several  master  alarms  occurred  immediately  alter 
this  change  (33:10,  33^41,  34:01,  and  34:32). 

At  36:48  the  hydrogen  tank  no.  1 heater  was  placed  back  to  auto 
for  the  sleep  period.  On  the  first  "down"  pressure  cycle  a master 
alarm  occurred  (38:00)  due  to  hydrogen  tank  no.  1 pressure  dropping 
lower  than  224.24  psia,  awaking  the  crew.  The  crew  reset  the  alarm, 
and  no  master  alarms  occurred  through  the  sleep  period  although  the 
heaters  cycled  several  times . To  obtain  a balanced  condition  for  the 
next  sleep  period,  the  ground  controllers  devised  the  following  plan 
for  the  next  day's  operation: 

1.  After  crew  wakeup,  turn  hydrogen  tank  no.  2 heater  to  off  and 
leave  hydrogen  tank  no.  1 in  auto  for  two  to  three  pressure  cycles  to 
determine  if  this  will  transfer  heater  control  to  tank  no.  1 in  antici- 
pation of  using  this  configuration  for  sleep. 

2.  If  successful,  tank  no.  1 heaters  will  be  turned  off  during  the 
day  and  tank  no.  2 heaters  left  in  auto  to  create  a quantity  unbalance 
in  favor  of  tank  no.  1. 

3.  During  the  next  sleep  period,  the  tanks  will  be  balanced  by 
placing  tank  no.  1 heaters  in  auto  and  tank  no.  2 heaters  to  off. 

This  plan  was  executed  when  the  crew  awoke  the  next  day.  At  the 
time  of  the  accident,  tank  no.  1 was  in  off  and  tank  no.  2 was  in  auto, 
and  the  caution  and  warning  master  alarm  was  reset  with  a low  hydrogen 
pressure  indication  present  at  55:52:30.  This  hydrogen  low  pressure 
indication  locked  out  the  master  alarm  during  the  time  of  the  increasing 
pressure  in  oxygen  tank  no.  2. 


Cryogenic  Tank  Destratification 

To  prevent  stratification  in  the  oxygen  and  hydrogen  tanks,  two 
fans  are  located  in  each  tank.  A diagram  of  the  oxygen  tank  showing 
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the  two  fans  and  quantity  gaging  probe  is  shown  in  figure  B4-11.  The 
flight  plan  called  for  the  fans  to  be  operated  in  both  the  hydrogen  and 
oxygen  tanks  at  the  following  times:  3:40,  12:09,  23:12  , 29: 4o,  37:30, 

and  46:39  g-e.t.  The  ground  controllers  requested  the  oxygen  tank  no.  2 
fans  to  be  operated  at  47:54  and  both  the  oxygen  and  hydrogen  fans  be 
operated  at  51:07- 

Review  of  cryogenic  and  electrical  instrumentation  data  does  not 
indicate  that  the  fans  were  switched  on  at  3:40  and  at  29:40.  No 
changes  in  cryogenic  pressures  and  quantities,  and  no  indications  of  an 
increase  in  spacecraft  current  were  noted.  The  operation  of  the  fans 
during  the  other  destratification  periods  were  normal;  however,  three 
oxygen  tank  no.  2 differences  were  noted:  (l)  transients  on  pitch  and 

yaw  thrust  vector  control  gimbal  command  parameters  at  fan  turnon  and 
turnoff,  (2)  quantity  gaging  probe  malfunctioned  just  after  or  at  the 
time  the  fans  came  on,  and  (3)  ac  main  bus  2 indicated  a 1.8-volt  nega- 
tive transient  when  the  fans  were  turned  on  at  47:54. 

The  pitch  and  yaw  thrust  vector  control  gimbal  command  (TVC  command) 
parameters  are  an  excellent  transient  detector  on  ac  main  bus  2 when 
the  stabilization  and  control  system  is  turned  off  because  of  its  sensi- 
tivity and  high  sampling  rate  (100  samples  per  second).  The  sensitivity 
of  the  system  is  determined  by  the  position  of  the  rate  high/low  switch 
and  the  attitude  deadband  maxlmum/minimum  switch.  The  TVC  command  sig- 
nals are  not  transmitted  to  the  ground  when  the  instrumentation  system 
is  in  low  bit  rate  mode. 

The  system  was  in  the  low  sensitivity  mode  during  two  destratifi- 
cation periods.  When  oxygen  tank  no.  2 fans  were  turned  on  during  tank 
destratification  periods,  a negative  initial  transient  was  detected  and 
when  the  fans  were  turned  off,  a positive  initial  transient  was  detected 
on  the  TVC  command  parameters . These  transients  are  readily  detectable 
in  the  high  sensitivity  mode  and  barely  detectable  in  the  low  sensitiv- 
ity mode.  Examination  of  the  Apollo  11  records  indicates  that  the  system 
was  in  the  high  sensitivity  mode  once  during  the  fan  destratification 
periods  and  a similar  transient  occurred  when  the  fans  were  turned  on. 

The  data  indicate  that  the  transients  are  normal  for  fan  turnon  and 
turnoff,  and  only  indicate  a relatively  large  current  change  on  ac  main 
bus  2. 

At  47:40:08  the  oxygen  quantity  changed  from  approximately  82  per- 
cent to  100  percent,  or  full-scale  high.  This  change  in  reading  or 
quantity  system  malfunction  occurred  just  after  or  at  the  time  the 
oxygen  tank  no.  2 fans  were  turned  on.  Because  of  the  way  the  system 
recovered  at  the  time  of  the  accident,  the  data  indicate  that  the  probe 
or  its  associated  wiring  shorted.  Since  the  instrumentation  system  was 
in  low  bit  rate,  it  is  possible  to  determine  exactly  when  the  oxygen 
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Figure  EL-11.-  Arrangement  of  components  within  oxygen  tank. 
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tank  no.  1 and  no.  2 fans  were  turned  on.  The  electrical  data  indicate 
that  the  oxygen  tank  no.  1 and  no.  2 fans  were  turned  on  between  the 
times  of  47:40:05  and  47:40:08.  A plot  of  cryogenic  pressures,  quanti- 
ties, total  CSM  current,  and  ac  main  bus  2 is  shown  in  figure  B4-12. 
Therefore,  the  oxygen  tank  no.  1 and  no.  2 fans  were  turned  on  in  a period 
of  time  between  3 seconds  prior  to  the  probe  malfunction  and  the  time 
that  the  probe  malfunctioned. 

When  the  oxygen  tank  no.  2 fans  were  turned  on  the  next  time  at 
47:54:50,  the  ac  main  bus  2 decreased  1.8  volts  for  one  sample  (0.1  sec- 
ond) . At  the  same  time  the  TVC  command  parameters  indicated  a negative 
initial  transient.  Because  of  the  sampling  rate  (10  samples  per  second) 
of  the  instrumentation  system  and  the  small  number  of  fan  cycles  examined 
in  the  high  bit  rate  mode,  it  cannot  be  determined  if  this  negative  ini- 
tial transient  is  characteristic  of  other  fan  turnon's  or  is  an  indica- 
tion of  a deteriorating  fan  or  wiring . 

The  complete  oxygen  and  hydrogen  tank  destratification  history 
prior  to  the  accident  is  shown  in  table  B4-I.  Changes  in  oxygen  and 
hydrogen  pressures  and  quantities  indicate  normal  destratification  of 
the  tanks  during  all  fan  cycles.  The  next  destratification  period 
occurred  at  55:53-18,  or  when  the  events  started  leading  to  the  accident. 

References  1 through  6 and  instrumentation  records  were  used  as  a 
source  of  information  and  data  in  the  preparation  of  this  part  of  the 
report . 


TABLE  B4-I.-  CRYOGENIC  TANK  DESTRATIFICATION 
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PARTB5 


INCIDENT  EVENTS 


INTRODUCTION 


This  part  of  the  report  covers  the  significant  events  which  took 
place  at  the  time  of  the  accident.  The  period  covered  is  55:52:00  g.e.t. 
to  56:00:05  g.e.t.  Prior  to  this  period,  spacecraft  operation  had  been 
essentially  according  to  plan  and  neither  the  ground  controllers  nor  the 
crew  had  any  warning  of  the  events  about  to  occur.  The  first  indication 
of  a problem  was  a loud  bang  heard  by  all  three  crew  members  which  was 
followed  by  a master  caution  and  warning.  The  immediate  indications  in 
the  spacecraft  were  that  this  warning  had  been  triggered  by  an  electrical 
transient.  Several  minutes  later  two  fuel  cells  failed  in  the  power 
system,  and  the  crew  became  fully  occupied  trying  to  reconfigure  the 
spacecraft  electrical  system.  Fourteen  minutes  later  they  noticed  vent- 
ing and  began  to  understand  what  had  actually  happened  in  the  cryogenic 
oxygen  system. 

On  the  ground,  the  flight  controllers  first  noticed  that  the  space- 
craft computer  had  been  automatically  restarted.  Shortly  afterwards , 

xcat ion  of  a master  caution  and  warning  caused  the  flight  controllers 
to  scan  their  data  for  a problem.  Since  many  telemetry  measurements  had 
by  this  time  departed  from  their  nominal  values,  the  ground  controllers' 
immediate  reaction  was  to  suspect  an  instrumentation  failure.  Steps  were 
undertaken  to  sort  the  false  telemetry  readings  from  the  true  ones;  and, 
simultaneously,  instructions  were  given  to  help  the  crew  handle  new  prob- 
lems. About  an  hour  later  the  ground  personnel  had  sorted  out  the  facts 
sufficiently  to  know  that  it  would  only  be  a short  time  before  the  cryo- 
genic oxygen  system  would  fail  completely. 

Reconstruction  of  the  mission  events  in  the  detail  presented  in  the 
following  pages  has  required  several  hundred  man-days  of  data  analysis. 
Consequently,  the  crew  and  mission  controllers  could  not  possibly  have 
understood  the  situation  in  the  same  depth  at  the  time  the  events  were 
actually  happening.  The  primary  sources  of  data  for  the  analysis  have 
been  telemetry  records,  transcripts  of  voice  communications,  crew  de- 
briefings, and  interviews  with  personnel  on  duty  in  Mission  Control. 

Table  B5-I  is  a detailed  chronology  of  the  events  during  this  time 
period,  and  figure  B5-1  shows  the  sequence  of  events  grouped  according  to 
spacecraft  systems.  For  events  obtained  from  telemetry  data,  where  time 
is  shown  to  a fraction  of  a second,  this  refers  to  the  time  at  which  the 
parameter  in  question  was  actually  sampled  by  the  telemetry  system.  As 
discussed  in  Part  B7  of  this  Appendix,  the  characteristics  of  the 
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telemetry  system  place  an  uncertainty  on  the  time  of  an  event.  The  un- 
certainty is  a function  of  the  telemetry  system  sampling  rate. 


The  remainder  of  this  section  is  a discussion  of  the  events  at  the 
time  of  the  accident,  grouped  according  to  the  spacecraft  systems  involved. 


TABLE  B5-I.-  DETAILED  CHRONOLOGY  FROM 
2.5  MINUTES  BEFORE  THE  ACCIDENT  TO  5 MINUTES  AFTER  THE  ACCIDENT 

Time,  g.e.t.  Event 

Events  During  52  Seconds  Prior  to  First  Observed  Abnormality 

55:52:31  Master  caution  and  warning  triggered  by  low  hydrogen 

pressure  in  tank  no.  1.  Alarm  is  turned  off  after 
h seconds. 

55:52:58  Ground  requests  tank  stir. 

55: 53: 06  Crew  acknowledges  tank  stir. 

55:53:18  Oxygen  tank  no.  1 fans  on. 

55:53:19  Oxygen  tank  no.  1 pressure  decreases  8 psi. 

55:53:20  Oxygen  tank  no.  2 fans  turned  on. 

55:53:20  Stabilization  control  system  electrical  disturbance 

indicates  a power  transient. 

55:53:21  Oxygen  tank  no.  2 pressure  decreases  h psi. 

Abnormal  Events  During  90  Seconds  Preceding  the  Accident 


55:53:22.718 

Stabilization  control  system  electrical  disturbance 
indicates  a power  transient. 

55:53:22.757 

1.2-volt  decrease  in  ac  bus  2 voltage. 

55:53:22.772 

11.1-amp  rise  in  fuel  cell  3 current  for  one 
sample . 

55:53:36 

Oxygen  tank  no.  2 pressure  begins  rise  lasting 
for  2h  seconds. 

55:53:38.057 

11-volt  decrease  in  ac  bus  2 voltage  for  one 
sample . 

55:53:38.085 

Stabilization  control  system  electrical  disturbance 
indicates  a power  transient. 
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TABLE  B5-I.-  DETAILED  CHRONOLOGY  FROM 
2.5  MINUTES  BEFORE  THE  ACCIDENT  TO  5 MINUTES  AFTER  THE  ACCIDENT  - Cont 


Time,  g.e.t. 

Event 

55:53:1*1.172 

22.9-amp  rise  in  fuel  cell  3 current  for  one  sample 

55:53:1*1.192 

Stabilization  control  system  electrical  disturbance 
indicates  a power  transient. 

55 : 5l*  -'00 

Oxygen  tank  no.  2 pressure  rise  ends  at  a pressure 
of  953. 8 psia. 

55  : 5I+ : 15 

Oxygen  tank  no.  2 pressure  begins  to  rise. 

55  : 5l* : 30 

Oxygen  tank  no.  2 quantity  drops  from  full  scale 
for  2 seconds  and  then  reads  75-3  percent. 

55 : 5l*  :31 

Oxygen  tank  no.  2 temperature  begins  to  rise 
rapidly. 

55  : 5l* : 1*3 

Flow  rate  of  oxygen  to  all  three  fuel  cells  begins 
to  decrease. 

55  : 5l* : 1*5 

Oxygen  tank  no.  2 pressure  reaches  maximum  value 
of  1008. 3 psia. 

55 : 5l* : 1*8 

Oxygen  tank  no.  2 temperature  rises  k0°  F for  one 
sample . 

55:51*:  51 

Oxygen  tank  no.  2 quantity  jumps  to  off-scale  high 
and  then  begins  to  drop  until  the  time  of  telemetry 
loss . 

55 : 5l+ : 52 

Oxygen  tank  no.  2 temperature  reads  -151.3°  F. 

55:54:52.703 

Oxygen  tank  no.  2 temperature  suddenly  goes  off- 
scale  low. 

55:54:52.763 

Last  telemetered  pressure  from  oxygen  tank  no.  2 
before  telemetry  loss  is  995-7  psia. 

55:54:53.182 

Sudden  accelerometer  activity  on  X,  Y,  and  Z axes. 

55:54:53.220 

Stabilization  control  system  body  rate  changes 
begin. 

TABLE  B5-I.-  DETAILED  CHRONOLOGY  FROM 

2.5  MINUTES  BEFORE  THE  ACCIDENT  TO  5 MINUTES  AFTER  THE  ACCIDENT  - Continued 


Time,  g.e.t. 


Event 


55:54:53-323  Oxygen  tank  no.  1 pressure  drops  4.2  psi. 

55:5!+: 53.  5 2.8-amp  rise  in  total  fuel  cell  current. 


55=54:53.542 


X,  Y,  and  Z accelerations  in  CM  indicate  l.lTg, 
0.65g  and  0.65g,  respectively. 


55:54:53-555 

55:54:53.555+ 


55:54:54.741 


55:54:55-35 


1,8-Second  Data  Loss 
Loss  of  telemetry  begins. 

Master  caution  and  warning  triggered  by  dc  main 
bus  B undervoltage.  Alarm  is  turned  off  in  6 
seconds.  All  indications  are  that  the  cryogenic 
oxygen  tank  no.  2 lost  pressure  in  this  time  period 
and  the  panel  separated. 

Nitrogen  pressure  in  fuel  cell  1 is  off-scale  low 
indicating  failed  sensor. 

Recovery  of  telemetry  data. 


Events  During  5 Minutes  Following  the  Accident 


55:54:56 

55:54:56 

55:54:56 

55:54:56 

55:54:56 


Service  propulsion  system  engine  valve  body  tem- 
perature begins  a rise  of  1.65°  F in  7 seconds. 

Dc  main  bus  A decreases  0.9  volt  to  28.5  volts 
and  dc  main  bus  B decreases  0.9  volt  to  29-0  volts. 

Total  fuel  cell  current  is  15  amps  higher  than  the 
final  value  before  telemetry  loss.  High  current 
continues  for  19  seconds. 

Oxygen  tank  no.  2 temperature  reads  off-scale  high 
after  telemetry  recovery. 

Oxygen  tank  no.  2 pressure  reads  off-scale  low 
following  telemetry  recovery. 
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TABLE  B5-I--  DETAILED  CHRONOLOGY  FROM 

2.5  MINUTES  BEFORE  THE  ACCIDENT  TO  5 MINUTES  AFTER  THE  ACCIDENT  - Continued 


Time,  g.e.t. 

Event 

55:5^:56 

Oxygen  tank  no.  1 pressure  reads  781.9  psia  and 
begins  to  drop  steadily. 

55: 5*+:  57 

Oxygen  tank  no.  2 quantity  reads  off-scale  high 
following  telemetry  recovery. 

55: 5**:  59 

The  reaction  control  system  helium  tank  C temperature 
begins  a 1.66°  F increase  in  36  seconds. 

55:55:01 

Oxygen  flow  rates  to  fuel  cells  1 and  3 level  off 
after  steadily  decreasing. 

55:55:02 

The  surface  temperature  of  the  service  module 
oxidizer  tank  in  bay  3 begins  a 3.8°  F increase 
in  a 15-second  period. 

55:55:02 

The  service  propulsion  system  helium  tank  temperature 
begins  a 3* 8°  F increase  in  a 32-second  period. 

55:55:09 

Dc  main  bus  A voltage  recovers  to  29-0  volts;  dc 
main  bus  B recovers  to  28.8  volts. 

55:55:20 

Crew  reports,  "I  believe  we've  had  a problem 
here . " 

55:55:35 

Crew  reports,  MWe’ve  had  a main  B bus  undervolt." 

55:55: U9 

Oxygen  tank  no.  2 temperature  begins  steady  drop 
lasting  59  seconds. 

55:56:10 

Crew  reports,  "Okay  right  now,  Houston.  The 
voltage  is  looking  good,  and  we  had  a pretty  large 
bang  associated  with  the  caution  and  warning  there. 
And  as  I recall,  main  B was  the  one  that  had  had 
an  amp  spike  on  it  once  before." 

55:56:38 

Oxygen  tank  no.  2 quantity  becomes  erratic  for 
69  seconds  before  assuming  an  off-scale-low  state. 
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TABLE  B5-I.-  DETAILED  CHRONOLOGY  FROM 

2.5  MINUTES  BEFORE  THE  ACCIDENT  TO  5 MINUTES  AFTER  THE  ACCIDENT  - Concluded 


Time,  g.e.t. 


Event 


55:57:04 


55:57:39 


55:57:40 

55:57:44 

55:57:45 


Crew  reports,  "That  jolt  must  have  rocked  the 
sensor  on — see  now — oxygen  quantity  2.  It  was 
oscillating  down  around  20  to  60  percent.  Now 
it's  full-scale  high  again.” 

Master  caution  and  warning  triggered  by  dc  main 
bus  B undervoltage.  Alarm  is  turned  off  in 
6 seconds. 

Dc  main  bus  B drops  below  26.25  volts  and  continues 
to  fall  rapidly. 

Ac  bus  2 fails  within  2 seconds. 

Fuel  cell  3 fails. 


55:57:59 

55:58:02 

55:58:06 

55:58:07 

55:58:07 

55:58:25 

56:00:06 


Fuel  cell  1 current  begins  to  decrease. 

Master  caution  and  warning  caused  by  ac  bus  2 
being  reset.  Alarm  is  turned  off  after  2 seconds. 

Master  caution  and  warning  triggered  by  dc  main 
bus  A undervoltage.  Alarm  is  turned  off  in  13 
seconds . 

Dc  main  bus  A drops  below  26.25  volts  and  in  the 
next  few  seconds  levels  off  at  25-5  volts. 

Crew  reports,  "ac  2 is  showing  zip." 

Crew  reports,  "Yes,  we  got  a main  bus  A undervolt 
now,  too,  showing.  It’s  reading  about  25-1/2. 

Main  B is  reading  zip  right  now." 

Master  caution  and  warning  triggered  by  high  hydrogen 
flow  rate  to  fuel  cell  2.  Alarm  is  turned  off  in 
2 seconds. 
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STATUS  OF  THE  SPACECRAFT  PRIOR  TO  THE  ACCIDENT 


At  55:52:00,  just  prior  to  the  accident,  the  electrical  system  was 
configured  as  shown  in  figure  B5-2.  Fuel  cells  1 and  2 were  supplying 
main  bus  A;  fuel  cell  3 was  supplying  main  bus  B.  The  power  for  the 
fans  in  cryogenic  oxygen  tank  no.  2 was  being  supplied  by  ac  bus  2,  as 
was  power  for  the  quantity  sensor  in  that  tank.  The  stabilization  control 
system  thruster  vector  control  system  was  receiving  its  power  from  ac 
bias  2.  Two  quantities  in  this  system,  the  pitch  and  yaw  thrust  vector, 
control  gimbal  commands,  though  not  intended  for  measurement  of  electri- 
cal system  currents  and  voltages,  are  sensitive  indicators  of  electrical 
transients  on  ac  bus  2.  These  quantities  are  telemetered  to  the  ground 
with  a sampling  rate  of  100  samples  per  second.  At  55:52:00  the  telemetry 
system  was  operating  in  the  high-bit— rate  mode  and  the  narrow  beam  antenna 
was  in  use. 


The  cryogenic  oxygen  tank  no.  2 quantity  gage  had  failed  to  a 100- 
percent  reading  in  the  46th  hour  of  the  flight.  (See  Part  B4 , the  sub- 
section entitled  "Spacecraft  Systems  Operation.")  All  other  cryogenic 
oxygen  instrumentation  was  operating  normally. 


The  cryogenic  hydrogen  tank  1 pressure  decreased  sufficiently  to 
trigger  the  master  caution  and  warning  at  55:52:31.  (For  a description 
of  the  master  caution  and  warning  system,  see  Part  2.10  of  Appendix  A.) 
The  ground  then  requested  a fan  cycle,  and  the  crew  acknowledged  the 
request.  A fan  cycle  consists  of  the  crew  turning  on  the  stirring  fans 
located  in  both  the  cryogenic  oxygen  and  hydrogen  tanks  and  allowing 
them  to  run  for  approximately  1 minute.  Normally,  the  hydrogen  fans 
are  turned  on  first,  followed  by  the  fans  in  oxygen  tank  no.  1 and  a 
few  seconds  later  by  the  fans  in  oxygen  tank  no.  2. 


FAN  TURNON  AND  ASSOCIATED  ELECTRICAL  ANOMALIES 


At  55:53:18  when  the  two  fans  in  cryogenic  oxygen  tank  no.  1 
were  turned  on  by  the  crew,  a drop  in  ac  bus  1 voltage  (fig..B5-3) 
and  an  increase  of  1 ampere  in  total  command  module  current  indicated 
that  the  fans  had  been  electrically  energized.  (Total  command  module 
current,  plotted  in  figure  B5-4,  is  obtained  by  adding  the  current 
outputs  of  all  three  fuel  cells  and  subtracting  the  current  drain  of 
the  lunar  module.)  A subsequent  decrease  in  tank  pressure  and  oscillations 
in  the  fuel  cell  flowmeters  indicated  that  the  fans  had  begun  to  stir 
the  oxygen  (fig.  B5-3). 

At  55:53:20  the  crew  turned  on  the  cryogenic  oxygen  tank  no.  2 fans. 

An  increase  in  fuel  cell  current  of  1-1/2  amperes,  a drop  in  ac  bus  2 
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Figure  B5-3(a) Telemetered  parameters  during  anomaly 
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Figure  B5-3 (b)  •-  Telemetered  parameters,  concluded. 
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voltage  of  0.6  volt,  and  a glitch  in  the  stabilization  control  system 
telemetry  indicated  that  the  fans  had  been  electrically  energized. 

These  events  are  shown  in  figures  B5-1*  and  B5-5*  However,  it  is  not 
certain  that  the  fans  began  rotating  at  this  time,  since  the  tank  no.  2 
pressure  showed  a minimum  observable  drop  and  the  fan  motor  stall  current 
does  not  significantly  differ  from  the  running  current.  The  quantity 
gage  in  tank  no.  2 was  already  in  a failed  condition,  and  the  fuel  cell 
flowmeters  were  already  being  affected  by  the  fan  operation  in  tank  no.  1 
so  that  neither  of  these  instruments  could  positively  verify  rotation 
of  the  fans  in  tank  no.  2.  During  the  next  20  seconds  a series  of 
electrical  anomalies  occurred  which  cannot  be  explained  as  a result  of 
known  loads  in  the  spacecraft.  These  anomalies  are  shown  in  figure  B5-1*. 
The  first,  at  55:53:23  was  an  11-amp  positive  spike  in  the  output  current 
of  fuel  cell  3.  Several  events  were  associated  with  this  spike: 

(a)  The  command  module  current  decreased  approximately  1/2  ampere 
immediately  afterward. 

(b ) The  ac  bus  2 voltage  had  a transient  decrease  and  then  began 
to  alternate  between  115*7  and  116.3  volts,  whereas  it  had  been  main- 
taining a steady  value  of  115*7  volts  since  fan  turnon. 

These  events  indicate  that  at  the  time  of  the  11-amp  spike,  a load 
may  have  been  disconnected  from  ac  bus  2.  This  could  have  been  one  of 
the  fan  motors  in  cryogenic  oxygen  tank  no.  2. 

At  55:53:38  another  abnormal  electrical  disturbance  occurred,  a 
3-amp  spike  of  current  and  variations  in  ac  bus  2 voltage.  The  ac  bus  2 
voltage  first  increased  2 volts  and  then  dropped  suddenly  from  ll6  to  105 
volts.  The  ac  bus  2 is  a three-phase  electrical  system,  although  the 
only  voltage  telemetered  is  phase  A.  The  operation  of  the  inverter 
which  generates  ac  bus  2 is  such  that  it  attempts  to  maintain  a constant 
average  voltage  among  the  three  phases ; if  one  phase  becomes  heavily 
loaded,  the  inverter  will  increase  the  voltages  of  the  other  two  phases. 
Consequently,  it  is  possible  that  the  voltage  rise  in  ac  bus  2 at 
55:53:37*8  was  caused  by  a heavy  load  applied  to  phase  B or  phase  C. 

The  decrease  in  voltage  immediately  afterward  was  probably  caused  by 
loading  of  phase  A. 

At  55:53:1*1  a 23  -amp  spike  occurred  on  fuel  cell  3 output  current, 
after  which  the  total  command  module  current  returned  to  a steady  value 
within  0.3  ampere  of  the  value  prior  to  turnon  of  cryogenic  oxygen 
tank  no.  2 fans.  Also,  the  voltage  of  ac  bus  2 returned  to  the  value  it 
had  shown  prior  to  fan  turnon.  At  the  same  time  transients  appeared  in 
the  stabilization  control  system,  as  shown  in  figure  B5-5* 

The  most  probable  cause  of  the  electrical  disturbances  between 
55:53:22  and  55:53:1*2  is  that  a short  circuit  occurred  in  the  electrical 
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system  of  the  cryogenic  oxygen  tank  no.  2 fans.  The  short  circuit  was 
sufficiently  severe  to  result  in  loss  of  part  of  the  fan  load  at 
55:53:22  and  the  remainder  at  55:53:1+1.  Reduction  of  the  load  could 
have  been  caused  by  fuses  blowing  or  by  wires  opening. 

It  should  be  noted  that  the  nature  of  the  telemetry  records  makes 
it  difficult  to  define  the  exact  parameters  of  the  electrical  disturbances . 
Since  the  value  of  fuel  cell  3 current  is  sampled  by  the  telemetry  system 
at  10  times  per  second,  the  duration  of  the  observed  current  spikes  is 
in  question  by  0.2  second.  Also,  the  peak  values  of  the  spikes  may  well 
have  exceeded  the  maximum  recorded  values.  For  similar  reasons  a large 
current  spike  could  possibly  have  occurred  at  55:53:38  simultaneous 
with  the  11-volt  decrease  of  ac  bus  2.  If  the  spike  were  very  short, 
less  than  0.1  second  duration,  it  could  have  occurred  between  the  times 
of  successive  telemetry  samples  and  thus  not  have  been  recorded. 

The  electrical  anomalies  ended  by  55 : 53: U2  and  no  further  electrical 
disturbances  were  observed  for  the  next  minute. 


OXYGEN  TANK  PARAMETERS 
FROM  55:53:30  UNTIL  LOSS  OF  TELEMETRY 


Thirteen  seconds  after  the  11-amp  spike  and  6 seconds  before  the 
23-amp  spike,  the  pressure  in  cryogenic  oxygen  tank  no.  2 began  a 
steady  increase  at  an  abnormally  rapid  rate.  The  increase  began  at 
55:53:35  and  lasted  19  seconds  before  the  pressure  reached  a plateau  of 
954  psia  for  21  seconds.  At  55: 5^:15  the  pressure  rise  resumed,  reaching 
a maximum  value  of  1008  psia  9 seconds  before  loss  of  telemetry.  During 
this  rise  the  master  caution  and  warning  trip  level  of  975  psia  was 
exceeded,  but  a master  alarm  was  not  generated  because  of  the  existing 
cryogenic  pressure  warning  occasioned  by  low  hydrogen  pressure.  After 
reaching  1008  psia,  the  pressure  decreased  to  996  psia  just  before  loss 
of  telemetry.  The  oxygen  flow  rate  for  all  three  fuel  cells  declined 
for  about  10  seconds  and  then  began  to  rise  just  before  loss  of  telemetry. 


The  pressure  transducer  for  cryogenic  oxygen  tank  no.  2 is  not 
located  in  the  tank  but  is  connected  to  the  tank  along  with  a pressure 
relief  valve  through  19  feet  of  tubing.  The  relief  valve  is  set  to  open 
fully  at  1008  psia.  (See  figure  B7-4  for  a diagram  of  this  portion  of 
the  cryogenic  oxygen  system  and  Part  B7  of  this  Appendix  for  a more 
complete  description  of  the  cryogenic  oxygen  pressure  sensing  system). 

The  remote  location  of  the  oxygen  pressure  transducer  causes  some  time 
lag  in  the  telemetered  pressure  data  but  unless  there  are  unknown 
restrictions,  such  as  clogging  of  the  filter  at  the  tank  end  of  the  line, 
this  lag  will  not  cause  serious  errors  in  the  pressure  reading  under  the 
conditions  observed. 
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TVC  Vaw  gimbal  command,  deg  TVC  pitch  gimbal  command,  deg 


Pitch  rate 


Pitch  gimbal  command 


Yaw  rate 


The  quantity  gage  for  oxygen  tank  no.  2,  which  had  ^en  in  failed 
state  ever  since  the  U6th  hour,  suddenly  dropped  to  6.6  percent  an 
then  to  off-scale  low  at  55=5^:30.  These  readings  do  not  prelate 
with  other  telemetered  data  and  are,  consequently,  thought  to  he 
erroneous^  The  gage  then  Jumped  to  a 75-percent  reading,  vhich^a  be 
^liable  data  since  it  is  about  the  value  to  he  expected.  Afterwards 
the  quantity  decreased  gradually  for  19  seconds  until  3 seconds  ^ore 
telemetry  loss,  at  which  time  an  erratic  gage  output  occurred.  The 
behavior^ of  this  type  of  gage  when  a short  across  the  ^citor^rohe 
is  removed  is  to  drop  to  zero  for  several  seconds  and  then  return 
P correct  reading.  However,  the  gage  has  other  failure  modes  which 
resSrfn  a wandering  false  indication.  See  Part  Bp  of  this  Appendix 
for  a discussion  of  the  quantity  gage.  Because  of  the  gag 
Behavior,  it  cannot  he  stated  with  complete  confidence  that  the 
75-percent  reading  obtained  at  55'-5^:32  is  reliable. 

The  temperature  in  cryogenic  oxygen  tank  no.  2 remained  at  190  F 
+2°  until  55^:31  when  a steady  rise  in  temperature  commenced.  At 
55:5^8  a single  data  sample  indicated  a reading  U0  degrees  higher  than 
the  adlacent  readings.  The  last  data  sample  before  loss  of  teleme  ry 
was  oJf-scale  low,  probably  indicating  a short  circuit  in  the  gage  or 
• • in  ai  qnnssed  in  Part  B7  of  this  Appendix,  the  time  constant  of 

the"1 1 emp e r at ur e sensor  is  in  the  order  of  at  ^^final’ off-"" 

^o!  because  of  the  slow  gage  response .the create - paused 

the  temperature  rose  between  55:54.31  and 

by  an  actual  temperature  rise  of  greater  magnitude. 

The  temperature  and  quantity  of  cryogenic  oxygen  tank  no.  1 remained 
qteadv  until  telemetry  loss.  The  pressure  remained  nominal  until 
0?2  Sc^d  prior  to  telemetry  loss,  when  a slight  drop  was  observed. 


LOSS  OF  TELEMETRY 


« the  T S-n-^tf^htenna 

SMTs  aS  Instrumentation1  Facility  in  California. 

l mS'of  h Sifnal  strength  recorder,  and  began  an  --tic  increase. 
Figure  B5-6  is  a plot  of  the  carrier  strength  received  at  the  85  ft 
antenna  corrected  by  8 dB  to  show  the  carrier  strength  received  at  the 
210- ft  Litenna.  The  210- ft  antenna  was  not  equipped  with  a signa 
strength  recorder . 
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Figure  B5-5--  Disturbances  observed  on  thrust  vector 
control  gimbai  command  signals. 
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Figure  B5-6.-  Received  S-band  downlink  power. 


# Telemetry  data  recovered  completely  1.8  seconds  after  the  loss  of 
carrier  power.  Sporadic  telemetry  data  are  available  within  the 
1.8-second  period. 

The  recorded  input  signal  to  the  PCM  bit  detector  provides  an 
indication  of  the  rapidity  with  which  the  telemetry  signal  was  lost. 
There  appears  to  be  some  degradation  in  signal— to— noise  ratio  in  the 
time  period  from  55:54:53.51  to  55  : 5*+:  53. 555.  This  may  have  been  the 
result  of  attitude  changes  of  the  spacecraft  causing  mispointing  of  the 
high-gain  antenna.  At  55:54:53:555  an  abrupt  change  in  the  character  of 
the  signal  occurred,  and  the  signal— to— noise  ratio  rapidly  decreased  in 
a period  of  1 millisecond.  The  limitations  in  the  available  records 
make  it  impossible  to  definitely  determine  the  speed  with  which  the  loss 
occurred,  but  an  estimate  is  1 millisecond. 

Although  figure  B5 -6  indicates  that  the  signal  required  0.3  second 
to  decrease  60  dB,  the  actual  time  was  probably  much  shorter.  The 
decrease  of  60  dB  in  0.3  second  is  the  same  as  that  obtained  when  the 
input  signal  is  abruptly  removed  from  the  receiver.  This  slow  response 
is  caused  by  long  time  constant  circuitry  in  the  automatic  gain  control. 


When  the  telemetry  signal  was  reacquired,  the  spacecraft  had 
switched  from  the  narrow-beam  antenna  to  the  wide-beam  antenna.  This 
has  been  verified  by  signal-strength  calculations  and  comparisons  of 
antenna  patterns  with  spacecraft  attitude.  The  spacecraft  is  designed 
to  automatically  switch  to  the  wide— beam  antenna  if  the  pointing  error 
of  the  narrow-beam  antenna  exceeds  3 degrees. 

If  a power  supply  interruption  larger  than  0.4  second  occurs  in 
the  communication  system,  the  system  design  is  such  that  the  power  output 
will  automatically  drop  19  dB  for  a 90-second  period.  This  power 
reduction  cannot  be  observed  in  the  received  signal  strength  after 
recovery  of  telemetry. 


SPACECRAFT  EVENTS  AT  THE  TIME  OF  TELEMETRY  LOSS 


A large  number  of  spacecraft  events  took  place  approximately  at 
the  time  of  telemetry  loss.  These  events  are  discussed  in  detail  in 
the  following  sections  as  they  relate  to  the  various  spacecraft  systems. 
This  section  describes  the  events  as  an  aid  in  understanding  their 
interrelationship. 

Within  the  last  second  prior  to  telemetry  loss,  several  indications 
of  spacecraft  motion  appeared  on  the  telemetry  records  of  body  accelerom- 
eters , and  roll,  pitch,  and  yaw  rate.  The  total  fuel  cell  current  in- 
creased by  3 amperes  at  the  last  data  sample. 


When  telemetry  data  were  restored  at  55*5^:55- 35 » a large  number 
of  channels  associated  with  the  electrical  system,  stabilization  control 
system,  and  cryogenic  system  showed  marked  changes  (fig.  B5-3).  Both 
dc  main  A and  main  B had  dropped  0-9  volt  and  the  master  caution  and 
warning  had  been  triggered  because  of  an  undervoltage  on  main  bus  B. 

The  undervoltage  triggering  level  is  26.25  volts  and  the  initial  voltage 
on  main  B registered  28.1  volts.  All  three  fuel  cell  currents  had 
increased  by  5 amperes  over  the  values  before  telemetry  loss.  Both 
ac  bus  voltages  had  maintained  their  previous  values.  All  telemetry 
readings  from  cryogenic  oxygen  tank  no.  2 showed  off-scale  readings. 

The  temperature  was  off-scale  in  the  high  temperature  direction,  the 
quantity  gage  read  100  percent,  and  the  pressure  gage  read  off-scale 
low.  The  capability  of  the  gage  is  to  read  pressures  as  low  as  19  psia. 
Cryogenic  oxygen  tank  no.  1 had  not  changed  temperature  or  quantity. 
However,  the  pressure  had  decreased  from  879  psia  to  782  psia.  The 
regulated  nitrogen  pressure  in  fuel  cell  1 dropped  to  zero  during  telem- 
try  loss  and  remained  at  zero.  The  continued  operation  of  this  fuel 
cell  indicates  a sensor  malfunction.  As  shown  in  figure  B5-7,  the 
wires  from  the  nitrogen  pressure  sensor  to  the  telemetry  system  pass 
along  the  front  of  the  shelf  which  supports  the  fuel  cells,  in  close 
proximity  to  the  panel  covering  bay  4.  It  is  quite  possible  that 
damage  to  these  wires  caused  the  change  observed  in  the  nitrogen  pres- 
sure reading. 

Approximately  at  the  time  of  telemetry  loss  all  three  crew  members 
heard  a single  loud  bang.  One  or  two  seconds  later  they  noted  the  master 
caution  and  warning  caused  by  main  bus  B undervoltage  and  at  55:55:00 
turned  off  the  alarm.  They  also  verified  that  fuel  cell  currents  were 
normal  at  this  time.  Figure  B5-8  is  a photograph  of  the  command  module 
control  panel  showing  the  type  of  displays  provided  the  crew.  At 
55:55:20  the  crew  reported,  MI  believe  we've  had  a problem  here,”  and 
at  55: 55: 35 5 "We've  had  a main  B bus  undervolt."  Later  they  reported 
that  a computer  restart  had  occurred  at  the  time  of  the  bang,  which 
had  already  been  noted  in  Mission  Control. 

Photographs  later  taken  by  the  crew  show  the  panel  covering  bay  U, 
the  bay  containing  the  cryogenic  oxygen  tanks,  cryogenic  hydrogen  tanks, 
and  fuel  cells,  to  be  missing.  One  of  these  photographs  is  reproduced 
in  figure  B5-9  and  a photograph  prior  to  launch  is  shown  in  figure  B5-10. 
The  high-gain  antenna  located  adjacent  to  bay  k shows  a misalignment 
of  one  of  the  four  dishes.  The  photographs  also  show  that  the  axes  of 
fuel  cells  1 and  3 have  shifted  7 degrees  in  such  a way  that  the  tops 
of  the  fuel  cells  point  outward.  It  is  not  possible  to  determine 
conclusively  from  the  photographs  whether  or  not  cryogenic  oxygen  tank 
no.  2 is  present,  partially  missing,  or  totally  missing.  It  is  probable 
that  the  loud  bang  heard  by  the  crew  was  caused  by  the  separation  of 
the  panel  from  the  spacecraft  approximately  at  the  time  of  telemetry 
loss . 


B-57 


Figure  B5-7--  Location  of  wiring  to  nitrogen  pressure 
sensor  in  fuel  cell  1. 
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Figure  B5-8.-  Command  module  instrument  panel. 


Figure  B5-9--  Photograph  of  service  module  taken  by  crew. 
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Figure  B5-10.-  Bay  4 of  service  module. 
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CHANGES  IN  SPACECRAFT  DYNAMICS 


At  55:5^:53-182,  less  than  half  a second  before  telemetry  loss, 
the  body-mounted  linear  accelerometers  in  the  command  module,  which 
are  sampled  at  100  times  per  second,  began  indicating  spacecraft  mo- 
tions. These  disturbances  were  erratic  but  reached  peak  values  of 
1.17g,  0.65g,  and  0.65g  in  the  X,  Y,  and  Z directions,  respectively, 
about  13  milleseconds  before  data  loss. 

At  55:5^:53-220  the  pitch,  roll,  and  yaw  rate  gyros  indicated 
low- amplitude  variations  in  output.  These  gyros  are  body  mounted  in 
the  command  module,  have  a full-scale  range  of  ±1  degree  per  second* 
are  sampled  100  times  per  second,  and  provide  a fairly  sensitive 
indication  of  spacecraft  motions.  They  are  also  sensitive  to  electrical 
disturbances  not  necessarily  associated  with  the  gyros;  however,  the 
characteristics  of  the  output  at  55:5^:53.220  are  believed  to  have 
resulted  from  low-amplitude  dynamic  forces  acting  on  the  spacecraft. 
These  channels  were,  of  course,  lost  at  55 : 5^ : 53. 555 , along  with  all 
other  telemetered  data.  Figure  B5-11  is  a record  of  all  three  rate 
gyro  outputs. 

When  telemetry  was  recovered  at  55:5^:55-35,  these  channels 
definitely  indicated  that  moments  had  been  applied  to  the  spacecraft. 

The  total  change  in  angular  moment  was: 


Roll 

-1535 

ft-lb-sec 

Pitch 

-6>+82 

ft-lb-sec 

Yaw 

-5919 

ft-lb-sec 

The  roll,  pitch,  and  yaw  rates  were  automatically  compensated  for  by 
the  attitude  control  system,  as  shown  in  figure  B5-11. 

The  inertial  platform  on  the  command  module  contains  three 
mutually  orthogonal  integrating  accelerometers,  whose  outputs  are 
telemetered  with  an  increment  value  of  0.2  fps . After  telemetry  was 
recovered,  a change  of  two  increments  was  observed  in  one  axis , one 
increment  in  the  second  axis,  and  zero  increments  in  the  third  axis. 
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When  transformed  from  platform  coordinates  to  spacecraft  coordinates 
this  represents  a velocity  change  of  O.U  to  0.6  fps . The  uncertainty 
m this  measurement  is  due  to  the  fact  that  the  PCM  system  has  an 
increment  value  of  0.2  fps.  The  velocity  change  was  combined  with 
the  observed  roll,  pitch,  and  yaw  rates;  and  a single  equivalent  im- 
pulse acting  on  the  spacecraft  calculated.  The  impulse  components 
ar  e i 


500  lb-sec 
800  lb-sec 
-900  lb-sec 


This  indicates  that  the  force  was  directed  generally  normal  to  the 
panel  covering  bay  It  of  the  service  module.  The  extremely  coarse  data 
upon  which  this  calculation  is  based  makes  it  impossible  to  better 
define  the  force  acting  upon  the  spacecraft. 


_ A«er  recovery  of  data,  the  integrating  accelerometer  on  the  space- 
craft stable  platform  also  began  to  show  an  abnormal  output.  Calcula- 
tions  sho*  that  the  force  producing  the  acceleration  amounted  to  about 

minutes At  T f lection  (retro  thrust)  over  a period  of  about  8 
* At  about  the  same  time  Commander  Lovell  reported  seeing  ex- 
nofSflVe  VSn  ing  °f  Sases  from  the  service  module  which  definitely  was 

0r a*pected  Part  of  the  spacecraft  operation  at  that  time 
biv  l Ascribed  the  venting  as  continuous,  looking  like,  a 

big  sheet  with  the  sun  shining  on  it-very  heavy-like  fine  spray' 

spacecrSeop=ratL„snlike  V“ted  duTi^  °th-  Pl-ned 


, 6 radlal  velocity  of  the  Apollo  spacecraft  relative  to  the  Earth 

an  be  accurately  determined  by  measuring  the  doppler  shift  of  the  S-band 
signal  transmitted  to  Earth.  Spacecraft  velocity  components  normal  to 
the  line  between  the  spacecraft  and  Earth  cannot  be  determined  by  this 
method.  The  doppler  velocity  measurement  is  routinely  made  every 
10  seconds  and  has  an  equivalent  noise  level  of  0.015  fps. 


Between  55 : 5^ : i+5  and  55:55:05  doppler  measurements  indicated  a 
radial  velocity  increment  of  0.26  fps.  This  is  shown  in  figure  B5-12. 
following  this  abrupt  change  in  velocity  at  approximately  the  time  of 
telemetry  loss,  additional  velocity  changes  were  observed,  as  shown 
in  figure  B5-13.  These  velocity  increments  were  caused  in  part  by 

venting  from  the  spacecraft  and  in  part  by  firings  of  reaction  control 
system  jets. 
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The  jet  firings  caused  velocity  increments  rather  than  pure  rotation 
rate  changes  because  the  jets  did  not  always  fire  in  opposed  pairs.  This 
resulted  from  the  power  system  configuration  in  the  spacecraft  and  closure 
of  the  quad  C valves.  (See  Part  B 6 of  this  Appendix.) 


TEMPERATURE  CHANGES  OBSERVED  IN  SERVICE  MODULE 


Following  the  recovery  of  telemetry  data  there  were  a number  of 
temperature  changes  observed  at  various  locations  in  the  service  module. 
The  locations  of  all  temperature  sensors  in  the  service  module  are  shown 
in  figure  B5-l4,  and  telemetered  records  from  these  sensors  for  the  time 
period  of  55:53:40  to  55*56:10  are  shown  in  figure  B5-15-  From  these 
temperature  records  the  following  conclusions  can  be  drawn: 


1.  Both  temperature  measurements  in  bay  3,  the  bay  adjacent  to 
bay  4 , increased  after  55*5^-559  whereas  they  had  been  steady  prior  to 
that  time. 

2.  The  corresponding  temperature  measurements  in  bay  5 showed 
much  smaller  increases.  Bay  5 is  adjacent  to  bay  4. 

3.  A change  was  observed  in  the  service  propulsion  valve  body 
temperature.  This  sensor,  unlike  many  temperature  sensors  in  the  lower 
part  of  the  service  module,  is  not  covered  by  multiple  layers  of 
insulation . 

4.  Four  sensors  located  in  close  proximity  on  the  separator 
between  bay  4 and  bay  5 showed  rapid  temperature  rises  of  small 
magnitude  immediately  after  the  recovery  of  telemetry  data.  These 
sensors  measure  the  temperatures  of  fuel  cells  1 and  3 radiator  inlets 
and  outlets. 

5.  The  temperature  of  quad  C and  D reaction  control  engines 
continued  the  same  rate  of  rise  after  data  loss  as  before  data  loss. 


FAILURE  OF  CRYOGENIC  OXYGEN  SYSTEM 


The  telemetered  quantities  from  cryogenic  oxygen  tank  no.  2 were 
all  off-scale  following  the  recovery  of  telemetry  at  55:54:55.  Since 
no  accurate  assessment  of  the  damage  to  this  tank  has  been  possible, 
the  readings  of  the  sensors  within  it  are  in  doubt.  The  temperature 
was  reading  full-scale  high  and  continued  this  way  until  55:55:49, 
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Service  module  temperature  measurements 

Number 

Measurement 

number 

Title 

Remarks 

1 

SC2090 

Fuel  cell  1 radiator  inlet 

2 

SC2091 

Fuel  cell  2 radiator  inlet 

3 

SC2092 

Fuel  cell  3 radiator  inlet 

4 

SC2087 

Fuel  cell  1 radiator  outlet 

5 

SC2088 

Fuel  cell  2 radiator  outlet 

6 

SC2089 

Fuel  cell  3 radiator  outlet 

Opposite  9 

7a 

SA2377 

Bay  2 oxidizer  tank  surface 

8 

SA2378 

Bay  3 oxidizer  tank  surface 

9 

SA2379 

Bay  5 fuel  tank  surface 

Opposite  8 

10a 

SA2380 

Bay  6 fuel  tank  surface 

11 

SP0002 

Helium  tank 

12 

SP0045 

Service  propulsion  valve  body 

13 

SP0048 

Service  propulsion  fuel  feed  line 

14 

SP0049 

Service  propulsion  oxidizer  feed  line 

15 

SP0054 

Service  propulsion  oxidizer  line 

16 

SP0057 

Service  propulsion  fuel  line 

Opposite  18  on  flange 

17a 

SP0061 

Service  propulsion  injector  flange  1 

18 

SP0062 

Service  propulsion  injector  flange  2 

Bay  6 opposite  21 

19a 

SR5013 

Reaction  control  helium  tank  quad  A 

20a 

SR5014 

Reaction  control  helium  tank  quad  B 

Bay  2 opposite  22 

21 

SR5015 

Reaction  control  helium  tank  quad  C 

Bay  3 

22 

SR5016 

Reaction  control  helium  tank  quad  D 

Bay  5 

23a 

SR5065 

Reaction  control  engine  package  quad  A 

Bay  6 opposite  25 

24a 

SR5066 

Reaction  control  engine  package  quad  B 

Bay  2 opposite  26 

25 

SR5067 

Reaction  control  engine  package  quad  C 

Bay  3 

26 

SR5068 

Reaction  control  engine  package  quad  D 

Bay  5 

27 

SC0043 

Hydrogen  tank  1 

28 

SC0044 

Hydrogen  tank  2 

Internal 

29 

SC2084 

Fuel  cell  1 skin 

30 

SC2085 

Fuel  cell  2 skin 

Internal 

31 

SC2086 

Fuel  cell  3 skin 

Internal 

32 

SC2081 

Fuel  cell  1 condenser  exhaust 

Internal 

33 

SC2082 

Fuel  cell  2 condenser  exhaust 

Internal 

34 

SC2083 

Fuel  cell  3 condenser  exhaust 

Internal 

35 

SF0260 

Environmental  control  primary 
radiator  inlet 

36 

SF0262 

Environmental  control  secondary 
radiator  inlet 

Bay  6 opposite 

37a 

SF0263 

Environmental  control  secondary 
radiator  outlet 

38 

ST0840 

Nuclear  particle  detector 

39 

ST 0841 

Nuclear  particle  analyzer 

40 

SC0041 

Oxygen  tank  1 

41 

SC0042 

Oxygen  tank  2 

a Located  on  opposite  side  of  vehicle  and  not  shown  in  the  view. 


Figure  B5-l4.-  Temperature  sensor  location 


in  Apollo  service  modu 


b-69 


100 


o 

o 


E £ 


T3 

n3 

ct 


£ <5 


£ 

O 

-P 

U) 

2 

o 

Jh 

3 

-p 

Ctf 

M 

<D 

i" 

<D 

-P 

a> 

i — i 

3 

2 

o 

£ 

CD 

O 


a> 

co 

i 

LTA 

i — I 

I 

Lf\ 

pq 


3 

hfl 

•H 

f2 


j0  'ajn^iadiuax 


B-70 


SC2087  temperature, 
fuel  cell  1 radiator  outlet 
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(b)  Radiator  outlet  temperatures. 
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Figure  B5- 15 • - Continued. 
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(d)  Service  propulsion  temperatures,  group  1. 
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55:53:40  55:54:00  55:55:00  55:56:00  55:57:00 

Ground  elapsed  time,  hr:min:sec 
(e)  Service  propulsion  temperatures,  group  2. 
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Figure  B5-15--  Continued. 
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Figure  B5-15 •-  Continued. 
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when  it  began  a steady  decrease  which  ended  at  55:56:48  in  an  off-scale- 
low  reading.  This  behavior  is  a possible  result  of  a failure  of  the 
sensor.  For  an  explanation  of  possible  failure  modes  of  this  sensor, 
see  Part  B7  of  this  Appendix.  The  pressure  of  cryogenic  oxygen  tank 
no.  2,  sensed  remotely,  read  off-scale  low  and  continued  to  show  this 
reading.  Off-scale  low  for  this  sensor  represents  a pressure  of  19  psia 
or  below. 

The  quantity  gage  read  full-scale  high  after  telemetry  recovery 
and  continued  in  this  state  until  55:56:58  when  it  began  oscillating  in 
an  erratic  manner.  The  oscillation  continued  until  55:57:47  when  the 
gage  assumed  an  off- scale-low  reading.  The  quantity  gage  and  its  fail- 
lore  modes  are  described  in  Part  B7  of  this  Appendix. 

The  pressure  in  cryogenic  oxygen  tank  no.  1 had  dropped  from  879 
psia  to  782  psia  during  telemetry  loss.  This  pressure  continued  to  drop 
at  a slow  rate  for  about  2 hours  until  it  was  insufficient  for  operation 
of  the  last  remaining  fuel  cell. 

The  heaters  in  both  cryogenic  oxygen  tanks  were  off  prior  to  te- 
lemetry loss  as  a result  of  the  high  pressure  in  tank  no.  2.  After 
telemetry  recovery  the  total  fuel  cell  current  indicated  an  increase  of 
about  5 amperes  after  known  loads  had  been  accounted  for.  The  low  pres- 
sure levels  in  both  oxygen  tanks  should  have  caused  both  heaters  to  be 
on  at  this  time.  The  total  current  drain  by  the  heaters  in  any  one  tank 
is  about  5 amperes.  It  therefore  appears  that  the  heaters  in  one  tank 
had  come  on  since  telemetry  loss  and  were  operating  at  this  time.  It  is 
possible  that  the  heaters  in  cryogenic  oxygen  tank  no.  2 were  either 
physically  open-circuited  before  or  at  the  time  of  the  bang. 

Additional  evidence  that  the  heaters  in  only  one  tank  were  on  can 
be  obtained  by  observing  that  at  56:19:03  the  spacecraft  dc  current 
decreased  5 amperes.  This  is  the  time  at  which  the  crew  began  to  power 
down  the  spacecraft  according  to  the  emergency  powerdown  checklist.  If 
heaters  in  both  oxygen  tanks  had  been  on  at  that  time,  the  current  should 
have  decreased  approximately  11  amperes  instead  of  the  observed  5 amperes. 


OPERATION  OF  THE  ELECTRICAL  POWER  SYSTEM 


Following  the  period  of  telemetry  loss,  a high-current  condition 
existed  on  the  fuel  cell  outputs  for  19  seconds.  In  the  same  time 
period,  the  two  dc  main  voltages  were  approximately  0.9  volt  lower  than 
their  previous  values.  By  55:55:14  the  voltages  and  currents  had  become 
normal.  The  observed  currents  during  the  19-second  period  have  been 
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correlated  with  reaction  control  system  jet  firings  and  an  inertial 
measurement  unit  heater  cycle.  The  excellent  correlation  indicates  that 
no  unaccountable  loads  were  added  to  the  power  system  during  this  time 
period. 

The  crew  observed  a master  caution  and  warning  signal  1 or  2 seconds 
after  the  bang,  along  with  an  indication  of  undervoltage  on  dc  bus  B. 

The  master  caution  and  warning  was  turned  off  at  55:55:00. 

Within  5 seconds  after  the  resumption  of  telemetry  data,  the  oxygen 
flow  rates  to  fuel  cells  1 and  3 had  decreased  to  approximately  20  per- 
cent of  their  prior  values.  These  flow  rates  remained  at  a sufficiently 
low  level  to  cause  failure  of  fuel  cells  1 and  3 at  approximately  55:58. 
The  most  probable  explanation  for  the  reduced  oxygen  flow  rates  is  that 
at  the  time  of  the  bang  a sufficiently  intense  shock  occurred  to  close 
the  valves  in  the  oxygen  lines  feeding  fuel  cells  1 and  3. 

There  is  sufficient  volume  in  the  oxygen  lines  between  the  supply 
valves  and  the  fuel  cells  to  maintain  fuel  cell  operation  for  the  ob- 
served time  of  about  3 minutes.  The  intensity  of  the  shock  is  indicated 
by  the  fact  that  the  reaction  control  system  valves  on  quad  C were 
closed.  Tests  on  these  valves  have  shown  that  80g  for  10  milliseconds 
will  cause  them  to  close.  Tests  on  the  oxygen  supply  valves  have  shown 
that  a shock  of  86g  for  11  milliseconds  will  cause  them  to  close. 

The  crew  was  not  alerted  to  the  abnormally  low  flow  rate  of  oxygen 
to  fuel  cells  1 and  3 because  the  hydrogen  supply  valves  had  not  been 
closed.  The  valve  closure  indicator  is  only  activated  when  both  the 
oxygen  and  hydrogen  supply  valves  to  a fuel  cell  are  closed.  The  first 
indication  to  the  crew  that  the  power  system  was  failing  came  at  55:57:59 
when  the  master  caution  and  warning  was  triggered  by  a main  bus  B under- 
voltage, occasioned  by  the  failure  of  fuel  cell  3.  Main  bus  B voltage 
dropped  to  an  unusable  level  within  5 seconds,  causing  ac  bus  2 to  drop 
to  zero  at  55: 57:  ^-5. 

The  crew  quickly  checked  the  ac  and  dc  voltage  levels,  recognized 
that  ac  bus  2 had  failed,  and  responded  by  switching  ac  loads  from 
ac  bus  2 to  ac  bus  1.  This  heavier  load  on  ac  bus  1 was  reflected  as 
a heavier  load  on  dc  main  A,  causing  it  to  drop  in  voltage.  At  55:58:06, 
a dc  main  A undervoltage  master  caution  and  warning  was  triggered  as  the 
main  voltage  dropped  to  between  25  and  26  volts.  Shortly  afterwards, 
at  approximately  55:58:06,  fuel  cell  1 failed,  placing  the  entire  load 
of  dc  main  A on  fuel  cell  2.  Fuel  cell  2 was  now  called  upon  to  supply 
a current  of  50  amperes. 

Fuel  cell  2 remained  the  major  source  of  electrical  power  in  the 
command  module  for  the  next  2 hours.  During  this  time,  telemetry 
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continued  to  indicate  a decreasing  cryogenic  oxygen  pressure  in  tank  no,  1. 
At  58: OU  battery  A was  connected  to  main  bus  A and  fuel  cell  2 was  removed 
from  operation  when  oxygen  flow  became  insufficient. 
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PART  B6 


POSTINCIDENT  EVENTS 


The  description  of  postincident  events  is  presented  in  two  sections. 
The  first,  entitled  nIrmnediate  Recovery,”  describes  the  flightcrew  and 
flight  controller  actions  during  the  2-l/2-hour  period  following  the  in- 
cident. This  section  is  primarily  concerned  with  actions  of  the  flight  - 
crew  and  flight  controllers  during  this  period  in  response  to  the  im- 
mediate problems  caused  by  the  spacecraft  failures.  The  long-term  prob- 
lems addressed  by  Mission  Control  are  described  in  the  second  section, 
entitled  "Plans  and  Actions  Taken  to  Return  the  Crew  to  Earth.” 


IMMEDIATE  RECOVERY 


The  first  indication  in  the  Mission  Control  Center  of  any  problem  in 
the  spacecraft  came  from  the  Guidance  Officer  who  reported  that  he  had 
observed  a "hardware  restart."  This  term  describes  the  action  of  the  on- 
board computer  when  certain  computer  electrical  problems  occur,  such  as  a 
reference  voltage  or  an  oscillator  frequency  getting  out  of  tolerance. 

When  this  occurs,  the  computer  stops  its  computations  and  recycles  to  a 
specified  location  in  the  program.  Computations  will  not  resume  until 
the  out-of-tolerance  condition  is  cleared.  At  55:55  this  event  occurred 
so  rapidly  that  the  flight  controllers  did  not  observe  the  computer  halt; 
they  only  saw  that  it  had  occurred. 

The  report  of  the  hardware  restart  was  followed  almost  immediately 
by  the  crew’s  report,  "I  believe  we’ve  had  a problem  here."  This  was 
followed  quickly  by  a statement  from  the  crew  that  they  had  a main  bus  B 
undervolt  indication  from  the  master  caution  and  warning  (MC&W)  system. 
Flight  controllers  responsible  for  the  electrical,  environmental  control, 
and  instrumentation  systems  immediately  searched  their  displays,  but  at 
that  time  there  were  no  indications  of  any  electrical  problems,  all 
voltages  and  fuel  cell  currents  appeared  normal.  Apparently,  the  main 
bus  B undervolt  problem  was  a transient  that  had  cleared  up,  for  the  crew 
next  reported  the  bus  voltages  were  "looking  good."  However,  the  flight 
controllers  knew  that  all  was  not  well  because  the  oxygen  tank  measurements 
indicated  some  major  problems  in  this  system,  or  its  instrumentation. 

The  next  report  in  Mission  Control  was  from  the  flight  controller 
responsible  for  the  communication  systems.  He  stated  that  the  high- gain 
antenna  on  the  spacecraft  had  unaccountably  switched  from  narrow  beam 
width  to  wide  beam  width  at  approximately  the  same  time  the  problem  had 
occurred. 


In  sorting  out  these  pieces  of  information,  the  flight  controllers 
initially  suspected  that  there  had  been  an  instrumentation  failure.  How- 
ever, with  the  subsequent  failure  of  main  bus  B and  ac  bus  2 it  became 
more  obvious  that  a serious  electrical  problem  existed.  The  flight  con- 
trollers considered  the  possibility  that  a short  had  occurred,  and  that 
this  was  in  some  way  related  to  the  unusual  behavior  of  the  high-gain 
antenna.  The  rapid  rate  at  which  so  many  parameters  in  the  electrical 
and  cryogenic  system  had  changed  state  made  it  Impossible  to  tell  which 
were  causes  and  which  were  effects. 

The  Mission  Control  Center  response  to  the  situation  is  described  in 
this  section  of  the  report.  The  time  interval  covered  is  from  55  hours 
58  minutes  ground  elapsed  time  (55:58  g.e.t.)  to  58:40  g.e.t.,  when  all 
power  was  removed  from  the  command  module  (CM).  The  major  portion  of  the 
activities  of  both  the  flightcrew  and  the  flight  controllers  in  this  time 
period  was  directed  toward  (l)  evaluation  and  management  of  the  electrical 
and  cryogenic  oxygen  problems;  (2)  maintenance  of  attitude  control;  and 
(3)  activation  of  the  lunar  module  (LM).  A chronological  listing  of  all 
significant  actions  is  presented  first.  This  is  followed  by  a more  de- 
tailed description  of  the  three  categories  of  activities  mentioned  above. 


Chronology  of  Spacecraft  Reconfiguration  Actions 

This  listing  was  obtained  from  transcripts  of  air-to-ground  voice 
records  (ref.  2)  and  the  "Flight  Director"  loop  in  the  Mission  Control 
Center.  Additional  information  was  obtained  from  interviews  with  members 
of  the  flight  control  team.  Some  editing  has  been  done  to  eliminate  the 
description  of  routine  actions  which  obviously  have  no  significance  to 
this  investigation:  examples  are  omni  antenna  switching  and  the  loading 

of  weight  and  inertia  information  in  the  digital  autopilot.  The  times 
at  which  specific  actions  are  listed  are  only  approximately  correct, 

(±1  minute)  since  there  was  no  precise  time  correlation  available. 

55:59  - Fuel  cell  main  bus  connection.-  Mission  Control  requested 
the  crew  to  connect  fuel  cell  1 to  main  bus  A and  fuel  cell  3 to  main 
bus  B.  Although  there  was  no  direct  evidence  the  crew  had  changed  the 
fuel  cell  and  main  bus  configuration,  the  flight  controller  believed  that 
this  -might  be  the  case.  The  configuration  prior  to  the  loss  of  main  bus  B 
was  as  follows:  fuel  cell  1,  main  A;  fuel  cell  2,  main  A;  and  fuel  cell  3? 

main  B. 

56:03  - Entry  battery  on  line.-  The  crew  placed  entry  battery  A on 
main  bus  A to  increase  the  bus  voltage.  Mission  Control  was  just  about 
to  ask  that  this  be  done.  The  bus  voltage  was  approximately  25  volts, 
which  is  about  1-1/4  volts  below  the  MC&W  trip  limit. 
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$6:08  - Open  circuit  fuel  cell  1.-  Mission  Control  requested  the  crew 
to  open  circuit  fuel  cell  1.  Flight  controllers  did  not  understand 
the  problems  with  the  fuel  cells;  the  data  were  confusing  and  incomplete. 
In  an  effort  to  get  some  new  information,  the  controllers  decided  to  take 
all  loads  off  fuel  cell  1 to  see  if  it  would  behave  any  differently. 

It  was  not  putting  out  any  power  so  there  was  no  reason  to  leave  it  con- 
nected to  the  main  bus. 

56:11  - Power  RCS  jets  from  main  bus  A.-  Mission  Control  requested 
the  crew  to  position  some  RCS  jet  select  switches  to  main  A power.  All 
of  the  quad  C jets  and  B-3  and  B-4  jets  had  been  powered  from  main  bus  B 
and  since  that  bus  had  no  power  on  it,  they  could  not  fire  except  by  the 
"Direct"  coils.  By  switching  these  jets  to  main  bus  A,  there  was  at  least 
one  jet  available  for  automatic  control  in  each  direction  about  each  axis. 

56:14  - Start  emergency  powerdown.-  Mission  Control  advised  the  crew 
to  use  page  1-5  of  their  Emergency  Powerdown  Checklist,  part  of  the  Flight 
Data  File  (ref.  7)  carried  by  the  crew.  Mission  Control  wanted  to  get  the 
current  on  main  bus  A reduced  by  at  least  10  amps,  and  then  take  the  entry 
battery  A off-line.  The  list  down  to  "BMAG  #2-off"  was  to  be  turned  off; 
it  included  the  following:  all  cryo  tank  heaters  and  fans,  G&N  optics 

power,  potable  water  heater,  SPS  line  heater,  SPS  gaging,  suit  compressor, 
all  fuel  cell  pumps,  SMRC  heaters,  ECS  radiator  heaters,  and  SPS  gimbal 
motors . 

56:25  - Power  AC  bus  2 with  inverter  (iNV)  1.-  The  crew  was  requested 
to  power  both  ac  busses  with  inverter  no.  1.  The  primary  purpose  was  to 
get  telemetry  data  from  oxygen  tank  no.  2 which  is  powered  by  ac  bus  2 
only. 


56:24  - Turn  fuel  cell  no.  2 pump  on.-  The  crew  had  turned  the  pumps 
off  in  following  the  emergency  powerdown  list.  The  pumps  circulate  glycol 
and  hydrogen  for  internal  cooling  in  the  fuel  cells.  They  could  have  been 
left  off  for  an  hour  or  more,  but  fuel  cell  performance  would  have  been 
degraded. 

56:50  - Select  main  bus  A power  to  RCS  jet  A-3 . - The  spacecraft  was 
drifting  in  pitch  without  any  apparent  control.  Qjiad  C,  which  should  have 
been  controlling  pitch,  did  not  seem  to  be  firing  at  all.  To  try  to  re- 
gain control  in  pitch,  the  quad  A-3  jet  was  switched  to  main  bus  A power. 

56:55  - Open  circuit  fuel  cell  no.  5 - - Same  reason  as  for  open  cir- 
cuit fuel  cell  no.  1. 

56:35  - Reconfigure  quad  B and  D thrusters. - Flight  control  felt  that 
a quad  B thruster  might  be  causing  the  spacecraft  attitude  deviations,  and 
asked  the  crew  to  take  off  all  power  to  the  quad  B jets.  To  compensate 


for  quad  B being  off,  all  jets  in  quad  D were  selected  to  be  powered  from 
main  bus  A. 

56:3^  - Battery  A taken  off  line.-  The  bios  loads  had  been  reduced 
sufficiently  to  allow  fuel  cell  2 alone  to  keep  the  bus  voltage  up. 

It  was  highly  desirable  to  use  the  battery  as  little  as  possible,  because 
there  was  no  guarantee  it  could  be  recharged. 

56:35  - Isolate  the  surge  tank.-  The  crew  was  directed  to  isolate 
the  CM  oxygen  surge  tank.  The  purpose  was  to  preserve  an  oxygen  supply 
for  reentry. 

56:38  - Oxygen  tank  no.  1 heaters  and  fans.-  Mission  Control  requested 
the  crew  to  turn  on  the  heaters  in  cryogenic  oxygen  tank  no.  1 in  an  effort 
to  build  up  the  tank  pressure.  The  current  was  observed  to  increase  about 
5 amperes,  Indicating  they  did  come  on.  About  2 minutes  later,  since  there 
was  no  increase  in  pressure,  the  crew  was  asked  to  turn  on  the  fans  in  this 
tank . 


56 : U5  - BMAG  2 off.-  In  an  effort  to  further  conserve  power,  the 
second  BMAG  was  powered  down. 

56:51  - Turn  off  thruster  C-l.  - Thruster  C-l  seemed  to  be  firing  very 
frequently  without  any  apparent  reason.  The  crew  was  requested  to  turn 
off  all  power  to  this  thruster.  The  attitude  disturbances  were  noted  to 
have  been  virtually  ended  at  about  56:^0. 

56:57  - Fuel  cell  no.  3 shutdown.-  Fuel  cells  1 and  3 had  been  open 
circuited  earlier  because  they  were  not  putting  out  any  power.  With  the 
cryogenic  oxygen  leaking  at  its  present  rate,  there  would  be  no  reactants 
for  the  fuel  cells  within  a short  time.  Because  there  was  a possibility 
that  the  oxygen  was  leaking  down  stream  of  one  of  the  fuel  cell  reactant 
valves,  it  was  decided  to  shut  off  these  valves  in  an  effort  to  save  the 
oxygen  remaining  in  tank  no.  1.  Fuel  cell  3 was  selected  because  it  had 
been  the  first  of  the  two  to  fail. 

57*03  - Main  bus  A power  to  thruster  A-U.-  The  crew  was  told  to  put 
power  to  thruster  A-h  by  connecting  to  main  bus  A.  The  spacecraft  had  a 
positive  pitch  rate  and  the  crew  was  unable  to  stop  it  with  quad  G thrus- 
ters. With  A-U  activated,  pitch  control  was  regained. 

57: 18  - Fuel  cell  no.  1 shutdown.-  Shutting  down  fuel  cell  3 did 
not  effect  the  oxygen  leak  rate,  so  the  reactant  valves  to  fuel  cell  1 
were  closed  in  an  effort  to  try  to  stop  the  leak. 

57:22  - Charge  battery  A.-  The  crew  was  directed  to  charge  battery  A. 
The  fuel  cell  2 was  maintaining  main  bus  A voltage  at  an  adequate  level 
to  support  the  battery  charger.  Mission  Control  decided  to  charge  battery  A 
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for  as  long  as  possible.  Since  the  oxygen  was  still  leaking,  it  was  ob- 
vious that  all  fuel  cell  operation  would  be  lost  within  about  an  hour. 

57:29  - Disable  power  to  quad  C. - It  appeared  that  quad  C was  not 
thrusting,  although  it  was  receiving  firing  signals.  The  explanation  of 
this  was  that  the  propellant  isolation  valves  had  been  closed  by  the  "bang" 
at  55:55  and  no  propellant  was  being  fed  to  the  thrusters.  Since  these 
valves  are  powered  by  the  main  bus  B,  they  could  not  be  opened  without 
getting  power  to  this  bus.  The  firing  signals  to  quad  C therefore  were  a 
useless  drain  of  power  on  bus  A,  and  the  crew  was  directed  to  disconnect 
the  thrusters  from  it. 

57:39  - Fans  on  in  oxygen  tank  no.  2. - In  a final  effort  to  try  to 
increase  the  pressure  in  oxygen  tank  no.  2,  the  crew  was  directed  to  turn 
on  the  fans  in  that  tank. 

57:40  - LM  power  on.-  The  crew  reported,  "I’ve  got  LM  power  on." 

57: 49  - Stopped  charging  battery  A. - In  order  to  be  ready  to  bring 
battery  A on-line  when  fuel  cell  2 failed,  it  was  decided  to  terminate 
the  charge.  A total  of  about  0.75  amp-hours  had  been  restored. 

57:53  - CSM  glycol  pump  off.-  To  reduce  the  main  bus  A loads,  the 
crew  was  directed  to  turn  off  the  glycol  pump  and  to  bypass  the  environ- 
mental control  system  radiators . 

57:55  - Turn  off  oxygen  tank  no.  2 fans.-  To  further  reduce  the  load 
on  main  bus  A,  the  pumps  in  fuel  cell  2 and  the  fans  in  oxygen  tank  no.  2 
were  turned  off. 

57:57  - LM  data  received.-  Low-bit-rate  telemetry  data  were  received 
in  the  Mission  Control  Center  at  this  time. 

58:04  - Battery  A on.-  The  crew  powered  main  bus  A with  battery  A in 
anticipation  of  the  loss  of  fuel  cell  2.  The  pressure  in  oxygen  tank  no.  1 
was  approximately  65  psi  at  this  time. 

58:07  - CSM  communication  reconfiguration.-  The  Command  Module  Pilot 
(CMP)  was  directed  to  turn  off  the  CSM  S-band  primary  power  amplifier  and 
to  select  low  bit  rate  and  down-voice  backup.  This  was  to  reduce  the  load 
on  battery  A and  maintain  adequate  circuit  margins  on  the  communication 
downlink. 

58:18  - CSM  guidance  and  navigation  powerdown.-  The  CSM  inertial 
platform  (IMU)  alignment  had  been  transferred  to_ the  LM  and  verified  by 
Mission  Control.  The  crew  was  directed  to  turn  off  the  CSM  computer,  the 
IMU,  and  the  IMU  heaters. 


58:21  - Powerdown  CM  attitude  control.-  In  an  effort  to  reduce  elec- 
trical power  requirements  in  the  CM,  the  CMP  was  directed  to  turn  off 
"SCS  Electronics  Power,"  and  "all  Rotational  Control  Power  Off."  This 
completely  removed  all  attitude  control  capability  from  the  CM. 

58:22  - LM  RCS  activation . - The  LM  crew  was  advised  to  pressurize 
the  RCS,  turn  on  the  thruster  heaters,  and  power  up  the  attitude  reference 
system. 

58:27  - Activate  "Direct"  attitude  control.-  It  was  discovered  that 
neither  module  was  configured  to  provide  attitude  control.  The  quickest 
way  to  regain  it  was  to  have  the  CMP  power  up  the  rotational  hand  con- 
troller and  the  Direct  coils. 

58:56  - Fuel  cell  2 shutdown.-  The  pressure  of  the  oxygen  being 
fed  to  this  fuel  cell  had  dropped  below  the  operating  level  at  58:15  and 
it  had  stopped  supplying  current.  As  part  of  the  CSM  "safing,"  the  fuel 
cell  was  disconnected  from  the  bus  and  the  reactant  valves  were  closed. 

58:40  - CSM  powered  down.-  Battery  A was  disconnected  from  main  bus  A 
at  this  time,  removing  all  power  from  the  CSM. 


Evaluation  of  Electrical  and  Cryogenic  Oxygen  Problems 

The  failure  of  fuel  cell  5 resulted  in  the  interruption  of  elec- 
trical power  to  several  components  in  the  spacecraft,  including  part  of 
the  telemetry  signal  conditioning.  Main  dc  bus  B was  being  powered  only 
by  fuel  cell  3,  so  when  its  output  dropped  from  about  25  amperes  to 
less  than  5 amperes,  the  bus  voltage  dropped  from  the  normal  28  volts  to 
less  than  5 volts  (fig.  B5-2).  Inverter  no.  2,  supplying  power  to  ac 
bus  2,  was  being  driven  by  main  bus  B and  dropped  off  the  line  when  the 
bus  B voltage  fell  below  about  16  volts.  The  bus  failures,  coupled  with 
the  cryogenic  oxygen  tank  indications  and  some  questionable  instrumentation 
readings  in  fuel  cells  1 and  3 (nitrogen  and  oxygen  pressures),  caused 
some  initial  uncertainty  in  the  Mission  Control  Center. 

The  initial  reaction  was  that  there  possibly  had  been  a problem  with 
major  related  instrumentation  discrepancies.  It  was  not  clear  that  the 
telemetry  quantities  of  cryogenic  oxygen  tank  measurements  or  the  fuel 
cell  parameters  were  valid  indications  of  conditions.  For  instance,  the 
indication  of  no  reactant  flow  and  no  fuel  cell  currents  was  compatible 
with  fuel  cells  1 and  3 having  become  disconnected  from  the  main  busses. 
Therefore,  there  was  no  reason  to  believe  that  they  could  not  be  recon- 
nected. The  lack  of  power  output  from  the  fuel  cells  could  not  be  ex- 
plained by  the  available  information,  i.e.,  the  rapidity  with  which  the 
fuel  cells  had  failed.  An  additional  factor  that  had  to  be  considered 
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was  that  the  high-gain  antenna  had  unaccountably  switched  from  narrow  to 
wide  beam  width  at  about  this  same  time.  Some  trouble  had  been  experienced 
earlier  in  getting  this  antenna  to  "lock  on"  in  narrow  beam  width,  and  the 
possibility  of  a short  in  the  antenna  electronics  could  not  be  ruled  out. 

The  first  direction  given  to  the  crew  was  at  56:00  to  return  the  bus 
power  configuration  to  the  normal  operating  mode;  that  is,  fuel  cell  1 
powering  bus  A and  fuel  cell  5 powering  bus  B.  The  primary  purpose  of 
this  direction  was  to  get  the  spacecraft  in  a known  configuration  and 
determine  if  the  fuel  cells  could  be  reconnected  to  the  main  busses. 

There  are  no  telemetry  parameters  which  show  which  fuel  cells  are  supplying 
power  to  which  busses,  but  the  flight  controllers  were  of  the  opinion  that 
some  reconfiguration  might  have  been  done  by  the  crew. 

In  operating  with  split  busses,  that  is,  with  two  fuel  cells  powering 
main  bus  A and  one  fuel  cell  powering  main  bus  B,  the  amount  of  equipment 
tied  to  bus  A represents  approximately  twice  the  load  as  that  to  bus  B. 

When  fuel  cell  1 failed,  fuel  cell  2 had  to  take  up  the  additional  load  on 
bus  A.  In  doing  so,  the  voltage  dropped  to  about  25  volts,  which  is  low 
enough  to  cause  a caution  and  warning  indication.  There  was  no  particular 
harm  in  the  bus  voltage  being  this  low,  but  if  it  dropped  any  lower  the 
performance  of  some  of  the  telemetry  equipment  would  be  affected  and  the 
flight  controllers  and  crew  were  concerned.  Normal  bus  voltage  is  above 
27  volts,  and  the  master  caution  and  warning  indication  is  triggered  at 
26-1/4  volts  or  less.  Had  fuel  cell  2 been  tied  to  both  main  busses  as 
on  previous  missions,  the  total  spacecraft  current  of  75  amperes  would 
have  driven  both  busses  as  low  as  21  volts.  The  crew  put  entry  battery  A 
on  bus  A at  56:05  to  bring  the  bus  voltage  up.  Mission  Control  concurred 
in  this  action. 

In  an  effort  to  obtain  more  data  for  troubleshooting  the  situation, 
the  crew  was  asked  to  read  out  the  onboard  indications  of  oxygen  pressure 
and  nitrogen  pressure  in  fuel  cells  5 and  1,  respectively.  At  56:08  the 
crew  was  requested  to  disconnect  fuel  cell  1.  This  fuel  cell  was  not 
supplying  any  power,  so  to  disconnect  it  should  have  no  effect  on  the  bus 
voltage,  but  there  was  a possibility  that  it  might  give  some  different 
indications  in  the  fuel  cell  telemetry  parameters.  There  was  no  change 
in  the  fuel  cell  parameters  when  it  was  disconnected  and  the  onboard 
readouts  of  nitrogen  and  oxygen  pressure  were  the  same  as  those  on  the 
ground,  which  did  not  add  to  the  understanding  of  the  situation. 

Efforts  to  sort  out  the  various  telemetry  indications  and  crew  re- 
ports continued  for  the  next  several  minutes.  The  next  direction  given 
to  the  crew  was  to  proceed  with  the  emergency  powerdown  of  the  electrical 
system,  using  page  EMER  1-5  of  the  CSM  Emergency  Checklist  which  is  part 
of  the  Flight  Data  File  carried  in  the  CSM  (ref.  7).  It  was  important  to 
reduce  the  electrical  loads  to  a low  enough  value  for  the  single  operating 
fuel  cell  to  be  able  to  supply  all  the  necessary  power.  Mission  Control 


was  anxious  to  get  entry  battery  A back  off  line  to  preserve  as  many  amp- 
hours  as  possible. 

The  next  step  in  the  attempt  to  determine  what  was  happening  was  to 
get  power  back  to  ac  bus  2.  Flight  controllers  considered  powering  ac 
bus  2 with  inverter  3 driven  from  main  bus  A.  Further  consideration, 
however,  led  to  the  decision  to  simply  tie  ac  bus  2 to  inverter  no.  1 
which  was  already  powering  ac  bus  1.  Mission  Control  was  interested  in 
getting  power  to  ac  bus  2,  since  this  is  the  only  bus  that  powered  the 
cryogenic  oxygen  tank  no.  2 quantity  and  temperature  telemetry.  A tem- 
perature measurement  was  needed  to  confirm  the  zero  pressure  indication. 
The  indications  from  oxygen  tank  no.  1 were  that  pressure  and  quantity 
were  decreasing  at  a relatively  high  rate  and  it  was  imperative  to  im- 
mediately establish  the  condition  of  tank  no.  2.  It  was  not  until  after 
ac  bus  2 had  been  powered  up  and  oxygen  tank  no.  2 indicated  empty,  that 
the  extreme  seriousness  of  the  situation  was  clear. 

In  proceeding  through  the  emergency  powerdown,  the  crew  had  placed 
the  fuel  cell  pump  switch  to  the  "off"  position  in  the  one  remaining  good 
fuel  cell;  however,  the  pumps  actually  went  off  with  loss  of  main  bus  B/ac 
bus  2 power.  At  56:24,  the  Lunar  Module  Pilot  (LMP)  pointed  this  out  to 
Mission  Control,  who  in  turn  directed  him  to  turn  the  pump  back  on.  The 
only  problem  associated  with  leaving  it  off  as  much  as  an  hour  is  that 
the  fuel  cell  power  output  would  start  to  degrade  and  no  harm  was  done. 

But  in  the  situation  that  existed,  it  is  not  inconceivable  that  had  the 
crew  not  advised  Mission  Control  of  the  fuel  cell  pump  being  off  it  would 
have  been  overlooked  until  a rise  in  the  fuel  cell  2 loop  temperatures 
gave  this  indication. 

Further  direction  in  the  management  of  the  electrical  system  was  not 
given  until  about  56:33.  At  this  time  the  crew  was  directed  to  open  cir- 
cuit fuel  cell  3 for  the  same  reason  as  fuel  cell  1 was  open  circuited 
earlier.  At  56:33  the  crew  was  requested  to  isolate  the  surge  tank  and 
at  approximately  this  same  time  Mission  Control  also  directed  the  crew 
to  remove  battery  A from  main  bus  A.  The  emergency  powerdown  had  re- 
sulted in  a load  reduction  such  that  the  fuel  cell  alone  could  maintain 
bus  voltage  above  27  volts . 

It  had  become  apparent  that  the  operation  of  fuel  cells  1 and  3 
probably  could  not  be  regained  under  any  condition,  and  that  with  oxygen 
tank  1 quantity  decreasing  at  its  then  present  rate,  the  service  module 
would  soon  become  incapable  of  providing  any  life  support  or  electrical 
power.  The  heaters  and  fans  in  this  tank  were  turned  on  at  56:38  in  an 
effort  to  increase  the  pressure,  but  to  no  avail.  Because  there  was  a 
possibility  that  a rupture  had  occurred  in  one  of  the  inoperative  fuel 
cells  and  the  oxygen  was  leaking  through  it,  Mission  Control  decided  to 
shut  down  the  cryogenic  inputs  to  fuel  cell  3 to  see  if  this  would  stop 
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the  leak,  and  the  reactant  valves  to  it  were  closed  at  57*00.  It  should 
he  pointed  out  that  this  is  an  irreversible  step;  once  a fuel  cell  is 
shut  down,  it  cannot  be  restarted  in  flight.  Fuel  cell  3 was  shut 
down  first  since  its  internal  oxygen  pressure  indication  was  zero;  there 
was  no  change  in  the  oxygen  tank  pressure  decay  rate,  however,  and  the 
reactant  valves  to  fuel  cell  1 were  closed  at  57:18,  with  equally  negative 
results.  Mission  Control  made  one  last  attempt  to  increase  oxygen  pressure 
by  directing  the  crew  to  turn  on  the  fans  in  tank  no.  2.  At  about  57:22, 
the  crew  was  directed  to  initiate  charging  of  battery  A.  By  this  time 
it  became  clear,  with  the  leaking  oxygen  tank  no.  1,  that  fuel  cell  2 
could  continue  to  operate  only  for  a short  period  of  time.  Since  the 
fuel  cell  was  maintaining  an  adequate  bus  voltage  and  could  provide  the 
additional  power  to  operate  the  battery  charger,  it  was  decided  to  charge 
battery  A as  long  as  possible.  The  charging  of  battery  A was  stopped  after 
22  minutes.  At  this  time  the  oxygen  tank  no.  1 pressure  had  decayed  to 
a point  where  continued  operation  of  fuel  cell  2 was  questionable.  Battery 
A was  to  be  connected  to  main  bus  A at  the  first  indication  that  the 
output  of  the  fuel  cell  was  decaying.  Since  the  battery  cannot  be  connect- 
ed to  power  a bus  while  it  is  being  charged,  it  was  necessary  to  terminate 
the  charging  in  anticipation  of  the  fuel  cell  failure. 

In  preparation  for  using  the  entry  battery  to  power  main  bus  A,  a 
further  reduction  of  the  loads  on  this  bus  was  performed.  The  following 
equipment  was  turned  off:  glycol  pump,  oxygen  tank  no.  2 fans,  and  fuel 

cell  no.  2 pumps. 

The  pressure  in  oxygen  tank  no.  1 was  approximately  65  psi  at  58: Ok 
when  the  crew  connected  battery  A to  main  bus  A.  This  is  below  the  mini- 
mum operating  pressure  for  the  fuel  cell.  This  battery  continued  to  power 
main  bus  A until  about  58:  U0.  By  this  time,  the  LM  had  been  activated 
and  the  inertial  platform  alignment  transferred  from  the  command  module. 

The  attempts  to  determine  the  cause  of  the  problem  in  the  electrical 
power  system  were  confused  by  the  misleading  symptoms  that  resulted  from 
the  cryogenic  tank  failure.  The  failure  in  the  electrical  power  system 
and  cryogenic  oxygen  was  so  massive  that  by  itself  it  would  have  created 
some  initial  confusion  and  made  the  flight  controllers  skeptical  of  the 
data,  but  in  addition  to  fuel  cell  output  dropping  to  zero  and  bus  voltages 
dropping  to  zero,  there  were  other  indications  that  had  to  be  considered. 
The  attitude  excursions  (now  presumed  to  have  been  caused  by  escaping 
oxygen)  and  the  peculiar  RCS  thruster  firings  added  to  the  confused  sit- 
uation. The  RCS  problems  are  discussed  in  more  detail  in  the  following 
section,  but  regardless  of  how  quickly  the  problem  in  the  electrical 
power  system  was  resolved,  there  was  nothing  that  could  have  been  done  to 
correct  it.  The  only  thing  the  crew  and  Mission  Control  could  do  under 
the  circumstances  was  to  preserve  as  much  capability  as  possible  for  re- 
entry and  to  power  down  in  an  orderly  manner  to  allow  time  for  LM  activa- 
tion. 


B-91 


Maintenance  of  Attitude  Control 


Within  3 minutes  after  reporting  the  large  bang,  the  Commander  (CDR) 
reported  some  of  the  "talkback"  indicators  for  the  service  module  reaction 
control  system  (SMRCS)  were  showing  "barberpole . " His  report  indicated 
that  the  helium  isolation  valves  to  quads  B and  D were  closed,  and  the 
secondary  propellant  fuel  pressurization  valves  to  quads  A and  C were 
closed  (fig.  B6-l).  These  valves  have  a history  of  inadvertant  closure 
when  the  spacecraft  is  subjected  to  a large  "jolt"  in  flight,  such  as  the 
spacecraft  separation  from  the  S-IVB.  This  phenomenon  was  first  en- 
countered on  Apollo  9-  To  reopen  a valve  that  has  closed  in  this  manner, 
it  is  necessary  to  cycle  the  position  selector  switch  to  "close"  and  then 
back  to  the  "open"  position.  All  of  the  switches  in  this  system  have 
momentary  "open"  and  "close"  positions,  and  are  springloaded  to  a center 
neutral  position. 

The  valve  position  indicators  in  the  spacecraft  are  the  flag  type 
which  show  gray  when  the  valve  is  open  and  gray-and-white  stripe  ("barber- 
pole")  when  closed;  there  is  no  telemetry  indication  of  the  valve  position. 
Each  valve  and  its  respective  indicator  are  powered  from  the  same  main  dc 
bus  and  cannot  be  selected  to  the  other  bus.  The  valves  in  the  propellant 
system  for  quads  B and  D are  powered  from  main  bus  A and  quads  A and  C are 
powered  from  main  bus  B.  Therefore,  there  was  no  way  to  determine  the 
status  of  the  RCS  propellant  and  pressurization  systems  of  quads  A and  C, 
and  there  was  no  way  to  reposition  the  valves  without  powering  up  main 
bus  B.  The  ability  to  open  the  isolation  valves  in  quads  B and  D was  not 
affected  by  the  loss  of  main  bus  B. 

Jet-firing  signals,  received  at  each  individual  thruster,  open  fuel 
and  oxidizer  valves  by  energizing  a coil.  There  are  two  coils  at  each 
thruster.  One,  called  "Auto,"  receives  its  signal  from  either  the  computer 
or  the  two  rotational  hand  controllers  (RHC’s)  and  can  be  powered  from 
either  main  dc  bus,  selected  by  the  "Auto  RCS  Select"  switches.  There  are 
16  switches;  one  for  each  individual  thruster  that  can  be  positioned  to 
"off,"  "main  A,"  or  "main  B. " The  other  coil  at  the  thruster  is  called 
"Direct"  and  receives  its  signal  from  the  rotational  hand  controllers  when 
they  are  rotated  sufficiently  far  from  the  null  detent.  There  are  several 
ways  of  configuring  the  RHC’s  to  power  the  Direct  coils.  Each  RHC  is 
limited  as  to  which  main  bus  and  thruster  combination  it  can  be  tied. 
Typically,  the  RHC’s  are  powered  so  that  half  the  jets  are  fired  by  main 
bus  B and  the  other  half  by  main  bus  A.  As  per  normal  procedure,  the  auto 
RCS  select  switches  were  configured  so  that  single- jet  authority  in  roll, 
pitch,  and  yaw  attitude  control  would  be  available  without  reconfiguring 
if  either  main  bus  were  lost.  This  protection  can  only  be  obtained  if  all 
four  quads  are  functional.  The  loss  of  capability  resulting  from  the 
failure  of  a main  bus  would  be  compounded  by  the  concurrent  closing  of 
propellant  isolation  valves.  Control  about  one  or  more  axes  would  be  lost 
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Figure  B6-1.-  Service  module  reaction  control  system  one 
quad  (typical  of  all  four). 
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until  some  reconfiguration  could  be  accomplished.  Because  power  to  the 
talkback  indicators  would  also  be  lost,  it  would  take  some  effort  to  de- 
termine the  status  of  the  control  system. 

At  the  time  of  the  accident,  the  spacecraft  was  performing  a computer- 
controlled  roll  maneuver  and  maintaining  pitch  and  yaw  attitude  hold.  The 
digital  autopilot  began  firing  RCS  thrusters  to  counteract  the  attitude 
perturbations  presumably  caused  by  the  oxygen  tank  no.  2 failure,  and 
attitude  was  completely  controlled  until  main  bus  B was  lost.  Soon  after 
the  loss  of  main  bus  B,  Mission  Control  noted  the  spacecraft  began  to  ro- 
tate about  the  pitch  and  yaw  axes.  It  was  also  noted  that  the  fuel  and 
oxidizer  pressures  in  quad  D were  decreasing  and  the  crew  was  asked  to 
verify  that  they  had  opened  the  helium  isolation  valves  which  had  pre- 
viously been  reported  as  closed.  Although  the  crew  did  not  acknowledge 
this  request,  the  pressures  were  observed  to  increase  to  the  normal 
operating  values  shortly  thereafter.  The  pressures  had  decreased  in  this 
quad  because  the  helium  pressurization  valves  had  been  jolted  closed  and 
subsequent  firings  of  the  thrusters  had  used  some  of  the  propellant.  This 
increased  the  ullage  volume  and  resulted  in  a noticeable  decrease  in  tank 
pressures.  The  flight  controllers  correctly  diagnosed  the  cause  and  were 
not  mislead  into  thinking  the  tanks  were  leaking. 

At  56:07  Mission  Control  noted  that  the  crew  had  turned  off  all 
Auto  RCS  Select  switches,  because  they  were  concerned  that  unwanted 
thruster  firings  were  causing  the  continuing  spacecraft  attitude  ex- 
cursions. At  about  56:15  the  spacecraft  was  observed  to  be  approaching 
gimbal  lock  of  the  inertial  platform.  Gimbal  lock  is  a condition  in 
which  the  inertial  platform  loses  its  reference  alignment.  To  prevent 
a gimbal  lock,  the  spacecraft  attitude  relative  to  the  inertial  platform 
must  be  kept  out  of  certain  regions.  Mission  Control  advised  the  crew 
of  this  situation,  and  in  an  effort  to  achieve  positive  control  about  all 
axes  of  the  spacecraft,  the  crew  was  directed  to  reconfigure  the  RCS  Auto 
Select  switches  for  thrusters  3 and  4 in  quad  B and  all  thrusters  in 
quad  C to  be  powered  from  main  bus  A.  This  would  provide  single-jet  con- 
trol authority  about  each  axis  (fig.  B6-2).  The  other  jets  were  not 
switched  to  main  bus  A power  in  order  not  to  drag  down  the  main  bus  A 
voltage  any  more  than  necessary.  The  LMP  acknowledged  and  the  drift 
toward  gimbal  lock  was  arrested,  although  all  rotations  were  not  stopped. 

At  56:22  the  CMP  reported  that  the  spacecraft  was  being  subjected  to 
pitch  and  yaw  rates  and  that  he  had  to  use  direct  control  with  the  rota- 
tional hand  controller  to  stop  them.  The  rates  would  start  to  increase 
again  as  soon  as  he  stopped  the  direct  control.  He  asked  if  the  ground 
could  see  any  spurious  jet  firings  that  might  be  causing  the  rates.  Al- 
though the  data  available  in  Mission  Control  were  not  complete  (the 
position  of  the  propellant  system  valves  in  quads  A and  C was  unknown 
and  firing  signals  to  the  Direct  coils  are  not  on  telemetry),  it  appeared 
to  the  flight  controllers  that  the  jet  firings  were  not  causing  the 


* Autopilot  can  be  configured  to  use  quads 
B and  D for  roll  or  A and  C. 


Figure  B6-2.-  SM  RCS  quad  location  and  thruster 
numbering  system. 
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spurious  rates.  It  was  observed  that  thruster  3 in  quad  C was  receiving 
firing  signals  almost  continuously,  but  was  having  no  success  in  stopping 
the  negative  pitch  rate.  In  an  effort  to  gain  control  over  the  negative 
pitch  rate,  at  56:32  Mission  Control  requested  the  crew  to  put  the  Auto 
RCS  Select  switch  of  thruster  3 of  quad  A on  main  bus  A.  It  was  suspected 
that  C-3  thruster  was  not  really  firing  because  there  was  no  perceptable 
reduction  in  quad  C propellant. 

At  about  56:35  the  crew  was  requested  to  remove  all  power  from  the 
quad  B thrusters  auto  coils  and  to  power  all  quad  I)  thrusters  from  main 
bus  A.  This  request  was  made  in  an  effort  to  determine  if  quad  B thrus- 
ters were  causing  the  unwanted  pitch  and  yaw  rates.  Mission  Control  con- 
tinued to  monitor  the  RCS  thruster  firings  and  the  spacecraft  attitude 
response,  trying  to  determine  the  status  of  the  system.  During  the  next 
10  minutes,  the  crew  pointed  out  that  the  quad  temperature  indications 
for  A and  B were  out  of  the  normal  operating  range,  and  Mission  Control 
assured  the  crew  that  they  were  within  acceptable  operating  limits.  In 
this  same  time  period  the  ground  had  noticed  numerous  firing  signals  of 
thruster  C-l.  Since  the  flight  controllers  could  see  no  explanation  for 
this,  the  crew  was  requested  to  remove  all  power  from  the  C-l  auto  coil 
at  56:53-  About  10  minutes  later,  the  CMP  reported  no  negative  pitch 
capability,  and  requested  clearance  to  enable  thruster  A-4.  Mission  Con- 
trol responded  immediately  to  "bring  A-4  on, " and  the  pitch  rate  was 
stopped  within  a few  seconds.  At  57:20,  Mission  Control  noted  a dis- 
crepancy in  the  roll  control  jet  configuration.  The  autopilot  was  con- 
figured to  use  quads  A and  C for  roll  control,  but  the  auto  coils  for 
these  jets  were  turned  off.  The  crew  was  directed  to  configure  the  auto- 
pilot to  use  quads  B and  D for  roll  control. 

Based  on  a close  observation  of  firing  signals  to  quad  C and  the 
resulting  spacecraft  response,  the  flight  controllers  thought  that  the 
quad  C propellant  isolation  valves  had  been  jolted  closed  by  the  incident 
that  caused  the  loud  bang.  The  computer  was  still  sending  firing  signals 
to  the  auto  coils,  but  they  were  apparently  having  no  effect  and  pro- 
pellant was  not  being  used  by  this  quad.  Therefore,  to  save  the  small 
amount  of  electrical  power  that  was  being  spent  by  sending  firing  signals 
to  the  coils,  at  57:29  Mission  Control  directed  the  crew  to  turn  off  the 
auto  coils  to  this  quad. 

Complete  attitude  control  appeared  to  be  established  at  this  time 
and  all  further  attitude  control  support  to  the  CSM  was  directed  toward 
transferring  control  to  the  LM.  The  overall  LM  activation  support  is 
described  in  more  detail  in  the  following  section;  however,  establishment 
of  the  attitude  control  of  the  LM  is  briefly  summarized  as  follows: 

1.  Mission  Control  referred  the  crew  to  specific  pages  in  the  LM 
Activation  Checklist  (part  of  the  Flight  Data  File,  ref.  7)  for  the 


procedure  to  transfer  the  inertial  platform  alignment  from  the  CSM  to 
the  LM. 


2.  The  CMP  was  directed  to  power  down  all  of  the  guidance,  naviga- 
tion, and  control  systems  after  the  LM  platform  had  been  properly  aligned. 

3.  Mission  Control  assisted  the  LM  crew  in  getting  attitude  control 
established  by  pointing  out  specific  circuit  breakers  that  needed  to  be 
closed  and  switches  that  needed  to  be  positioned. 

It  was  approximagely  1-1/2  hours  after  the  initial  incident  before 
complete  automatic  attitude  control  was  established,  although  the  crew 
had  manual  control  capability  at  all  times.  The  information  on  the 
ground  was  incomplete  and  was  confused  by  the  intermixing  of  automatic 
control  and  manual  direct  control.  Furthermore,  the  major  concern  was 
the  electrical  and  oxygen  problems,  and  the  only  mandatory  action  in  the 
control  system  area  was  to  maintain  a safe  posture  in  the  systems  and 
avoid  gimbal  lock.  These  mandatory  tasks  were  accomplished  and  in  due 
time  complete  attitude  control  was  established. 


Lunar  Module  Activation 

It  was  recognized  at  about  43  minutes  after  the  accident  that  the 
LM  might  have  to  be  used  to  provide  the  necessary  life  support,  and  the 
LM  activation  was  started  about  1-3/4  hours  after  the  crew  first  reported 
the  loud  bang  in  the  CSM.  The  first  hour  and  4f  minutes  were  spent  in 
regaining  positive  attitude  control  in  the  CSM,  in  troubleshooting  the 
electrical  problems  in  the  CSM,  and  in  attempting  to  halt  the  loss  of 
oxygen  from  the  service  module.  Since  LM  activation  did  not  begin  until 
the  lifetime  of  the  one  functioning  fuel  cell  was  predicted  to  be  about 
15  minutes,  there  was  a strong  motivation  to  complete  the  LM  activation 
and  CSM  powerdown  as  soon  as  possible. 

The  first  order  of  business  for  LM  activation  was  to  get  electrical 
power  and  the  communications  sytems  operating.  A specific  procedure  for 
this  was  read  to  the  LMP  at  57:37*  Although  three  checklists  for  LM 
activation  were  available  as  part  of  the  Flight  Data  File  in  the  space- 
craft, Mission  Control  did  not  direct  the  crew  to  follow  any  of  them. 

These  checklists  were  designed  for  three  different  situations  at  LM 
activation.  The  first,  entitled  "Apollo  XIII  LM-7  Activation  Checklist" 
(contained  in  ref.  7),  contains  the  nominal  mission  sequences  from  initial 
LM  manning  to  undocking  prior  to  the  lunar  landing.  The  other  two  activa- 
tion checklists  are  in  the  "LM  Contingency  Checklist"  (contained  in 
ref.  7).  They  were  written  to  cover  the  situations  of  having  to  use  the 
LM  to  perform  an  Earth-return  abort  maneuver  for  the  docked  CSM/LM  con- 
figuration. One  checklist  includes  activation  of  the  primary  guidance 
and  navigation  system  (inertial  platform  alignment,  etc.)  and  is  called 
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the  "2-Hour  Activation  List"  because  it  was  designed  to  be  completed  at 
a comfortable  pace  in  time  to  execute  a descent  propulsion  system  maneu- 
ver in  2 hours  elapsed  time.  The  other  contingency  list  is  called  the 
"30-Minute  Activation  List,"  and  serves  the  same  purpose,  except  that 
many  steps,  including  the  G&N  activation,  are  omitted.  There  was  no  LM 
activation  checklist  available  which  was  designed  to  cover  the  specific 
situation  resulting  from  this  incident.  The  features  that  were  different 
are  as  follows: 

1.  The  need  to  get  the  LM  totally  activated  as  soon  as  possible- 
including  attitude  control  as  well  as  supplying  life  support,  communica- 
tions, and  electrical  power. 

2.  The  desire  to  power  down  the  CSM  as  soon  as  possible  in  order 
to  preserve  all  available  battery  power  for  reentry. 

3.  The  LM  was  to  serve  as  a "lifeboat"  supplying  oxygen,  water, 
electrical  power,  and  attitude  control  for  80  or  90  hours. 

This  presented  a paradoxical  situation  in  which  almost  total  LM 
capability  was  required,  but  at  the  same  time  its  consumables  had  to  be 
conserved  as  much  as  possible.  In  responding  to  the  situation,  the  flight 
controllers  referred  the  crew  to  specific  pages  in  the  normal  "LM  Activa- 
tion Checklist,"  augmented  with  additional  instructions.  The  purpose  was 
to  bypass  all  steps  that  were  not  absolutely  necessary  for  getting  the  LM 
power,  communication,  and  environmental  control  system  in  operation.  The 
total  instructions  given  to  the  crew  referred  to  only  4 pages  of  the  59 
in  the  checklist.  There  were  three  single  instruction  additions  to  this 
shortly  afterward  which  completed  the  LM  configuration  for  supplying  oxygen 
to  the  cabin.  Although  this  particular  contingency  had  never  been  simu- 
lated in  the  training  exercises  in  preparation  for  the  mission,  similar 
cases  had  been  considered,  and  Black  Team  personnel,  including  the  Flight 
Director,  Glynn  Lunney,  had  prepared  procedures  and  criteria  for  using 
the  LM  to  augment  the  CSM.  The  simulations  had  been  limited  to  cases 
where  the  LM  ascent  stage  was  to  be  retained  following  rendezvous  in  lunar 
orbit.  These  same  personnel  had  participated  in  these  simulations  for  the 
preceeding  missions  of  Apollo  10,  11,  and  12,  and  therefore  were  familiar 
with  the  problems. 

The  next  procedure  given  to  the  crew  was  designed  to  get  the  LM 
guidance  and  navigation  system  operating  and  to  get  the  LM  inertial  plat- 
form aligned  to  a known  reference.  Again,  Mission  Control  referred  the 
crew  to  specific  pages  in  the  "LM  Activation  Checklist,"  along  with 
certain  necessary  circuit  breaker  closures  which  were  not  listed  on  those 
pages.  Although  the  necessary  circuit-breaker  panel  configuration  for  LM 
activation  is  shown  on  two  pages  in  the  checklist,  the  crew  was  not  re- 
ferred to  those  pages  by  Mission  Control.  In  order  to  save  time,  only 


the  necessary  circuit  breakers  were  given  as  part  of  each  set  of  special 
instructions.  The  omission  of  a necessary  circuit  breaker  closure  later 
caused  some  delay  in  establishing  LM  attitude  control. 

Throughout  this  period  of  LM  powerup,  the  CMP  was  given  frequent  in- 
structions on  the  CM  configuration  to  reduce  power  requirements.  The  crew 
completed  an  alignment  of  the  LM  IMU  to  the  CSM  IMU  at  58:09.  The  platform 
gimbal  angles  for  both  spacecraft  were  read  to  the  ground  for  computation 
of  the  fine -align  torquing  angles  for  the  LM.  As  soon  as  the  LM  IMU  was 
aligned,  the  CMP  was  directed  to  power  down  the  CM  computer  and  the  IMU, 
including  the  IMU  heaters. 

At  about  58:17  the  temperature  of  the  coolant  loop  in  the  LM  began 
to  rise  and  the  LM  crew  was  advised  to  activate  the  sublimator,  referring 
to  the  appropriate  page  in  the  "LM  Activation  Checklist."  During  the 
next  2-  to  3-minute  period  there  was  an  unusually  high  density  of  conver- 
sation, both  in  the  Mission  Control  Center  and  on  the  air-to-ground  fre- 
quency between  the  CAPCOM  and  crewmen  in  both  spacecraft  modules.  The 
CMP  reported  powering  down  the  CM  control  system;  the  CDR  reported  he  had 
no  attitude  reference  system  and  requested  permission  to  "close  the  FDAI 
circuit  breakers  so  we  could  have  a ball  to  see  if  we  go  to  gimbal  lock"; 
both  the  CMP  and  the  LMP  reported  conditions  and  asked  questions  regarding 
configuration  items;  and  on  the  ground  the  CSM  flight  controllers  were 
trying  to  get  their  systems  powered  down  as  much  as  possible  while  the  LM 
flight  controllers  were  trying  to  "get  through"  to  the  LMP  to  pressurize 
the  LM  RCS  and  to  turn  the  thruster  heaters  on. 

At  approximately  58:21,  the  CMP  was  told  to  continue  his  powerdown 
by  turning  off  the  power  to  the  rotational  hand  controller  almost  simul- 
taneously with  the  LM  crew  being  directed  to  power  up  the  FDAI  and  the  RCS 
heaters,  pressurize  the  RCS,  and  open  the  main  shutoff  valves.  After  about 
5 minutes,  when  it  became  clear  that  neither  spacecraft  had  control  of 
the  attitude,  the  CMP  was  directed  to  reactivate  the  CSM  Direct  attitude 
control  capability.  This  was  done  and  the  LM  crew  then  proceeded,  following 
instructions  from  the  ground,  to  pressurize  the  RCS  and  to  perform  the 
steps  necessary  to  get  the  attitude  reference  system  operating  in  the  LM. 
Mission  Control  at  58:32  gave  the  LM  crew  the  inputs  for  the  onboard  com- 
puter which  set  the  proper  system  gains  for  the  LM  autopilot  to  control 
the  docked  spacecraft  configuration.  The  LM  achieved  complete  automatic 
attitude  control  capability  at  58:3^?  when  the  crew  received  direction 
from  Mission  Control  to  close  an  essential  circuit  breaker  that  had  been 
previously  overlooked.  The  position  of  this  circuit  breaker  is  not  in- 
dicated on  telemetry,  but  the  flight  controller  correctly  diagnosed  the 
problem  when  the  crew  stated  they  still  did  not  have  automatic  control 
at  58:33. 

After  it  was  definitely  established  that  the  LM  had  attitude  control, 
the  CMP  was  given  final  instructions  for  completely  powering  down  the  CM, 
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and  work  toward  getting  the  LM  configured  for  the  long  trip  home  proceeded. 
Mission  Control  gave  the  crew  the  LM  IMU  torquing  angles  to  get  the  plat- 
form fine  aligned  to  the  reference  orientation.  Discussions  were  held 
between  the  ground  and  the  spacecraft  concerning  the  ability  of  the  crew 
to  use  the  stars  as  a reference  for  platform  realignment.  It  was  con- 
cluded that  this  would  be  difficult  if  not  impossible  to  do,  and  the 
current  alignment  should  be  preserved  until  after  the  abort  maneuver. 

An  abnormally  high  pressure  reading  was  noted  in  one  of  the  LM  ascent 
stage  oxygen  tanks  shortly  after  telemetry  data  were  received  in  Mission 
Control,  and  the  crew  was  directed  to  use  oxygen  from  this  tank  instead 
of  the  descent  tank.  Later  it  was  diagnosed  that  the  shutoff  valve  leaked, 
allowing  the  higher  pressure  oxygen  from  the  manifold  to  leak  into  this 
ascent  tank.  The  condition  in  itself  was  not  a problem;  the  net  effect 
was  that  this  ascent  tank  was  raised  to  a slightly  higher  than  normal 
pressure  which  was  well  within  the  tank  limits.  This  degraded  the  system 
redundancy,  however,  and  had  a subsequent  leak  deveuoped  in  this  tank,  the 
LM  oxygen  supply  would  have  been  depleted  (fig.  B6-3). 

The  next  phase  of  activity  was  devoted  to  reducing  the  power  drain 
from  the  LM  batteries  to  as  low  a value  as  practical.  This  included 
turning  off  many  of  the  displays  in  the  LM  and  put  Mission  Control  in 
the  position  of  monitoring  system  parameters  for  the  crew.  The  crew  was 
also  given  all  the  information  required  to  execute  a return-to-Earth  abort 
maneuver  2 hours  after  passing  the  point  of  closest  approach  to  the  Moon 
(pericynthion) . Providing  this  data  well  in  advance  is  a normal  procedure 
which  gives  the  crew  the  capability  to  perform  the  abort  if  communications 
are  lost  with  the  ground. 


PLANS  AND  ACTIONS  TAKEN  TO  RETURN  THE  CREW  TO  EARTH 


After  the  crew  had  powered  down  the  CM  and  activated  the  LM,  the 
immediate  situation  had  stabilized,  and  Mission  Control  could  direct  its 
full  resources  to  the  long-term  problem  of  getting  the  crew  safely  home. 
The  first  item  of  concern  was  to  determine  an  expected  LM  consumables 
lifetime  and  to  develop  a trajectory  plan  that  would  return  the  spacecraft 
to  Earth  within  this  lifetime.  Also  it  was  mandatory  to  reduce  the  ex- 
penditure of  battery  power  and  water  as  much  as  practical. 

Subsequent  efforts  by  Mission  Control  in  support  of  the  crew  were 
varied  and  extensive.  Much  of  this  activity,  however,  is  normally  part 
of  the  routine  functions  of  Mission  Control.  Such  items  as  monitoring 
systems  performance  via  telemetry  parameters;  keeping  accurate  records 
of  consumables  usage,  and  predicting  future  consumption  rates;  scheduling 
crew  rest  periods;  and  orbit  determination  are  only  some  of  the  examples 
of  this  normal  activity.  However,  only  the  special  activities  which  were 
unique  to  this  mission  failure  or  which  were  of  major  importance  to  the 
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Figure  B6-3 Schematic  of  LM  oxygen  storage  system. 
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successful  return  of  the  crew  will  be  described.  These  activities  are 
grouped  in  three  categories  in  this  report  and  described  as  independent 
subjects.  These  categories  are  consumables  and  system  management,  return 
to-Earth  trajectory  control,  and  definition  of  procedures  and  checklists 
for  reentry  preparation.  No  attempt  is  made  to  describe  the  events 
chronologically.  The  Mission  Operation  Report  (ref.  5)  contains  a com- 
prehensive documentation  of  these  events. 


Consumables  and  Systems  Management  Actions 

Consumables  and  systems  management  of  both  the  LM  and  the  CM  were  of 
vital  importance  and  generated  much  activity  in  Mission  Control. 

Lunar  module . - 

Electrical  power  system:  All  LM  electrical  power  is  supplied  by 
batteries.  There  are  four  in  the  descent  stage  with  a total  rated  ca- 
pacity of  1600  amp-hours  and  two  in  the  ascent  stage  with  a total  rated 
capacity  of  592  amp-hours.  After  the  LM  activation,  analyses  of  power 
requirements  and  lifetime  capability  were  completed.  These  analyses 
showed  that  after  the  abort  maneuver  at  61:30,  the  LM  could  be  powered 
down  to  a total  current  requirement  of  about  27  amps  and  still  keep  the 
inertial  platform  aligned.  This  was  extremely  important  because  it  made 
it  possible  to  perform  a guidance -controlled  abort  maneuver  at  79:30  which 
could  be  used  to  reduce  the  return  time  back  to  Earth  from  152  hours  to 
l4j  hours  g.e.t.  The  analyses  also  indicated  that  if  the  guidance  system 
was  completely  powered  down  after  79:30,  the  total  power  requirement  could 
be  reduced  to  about  17  amps,  stretching  the  battery  lifetime  to  approxi- 
mately 165  hours  g.e.t.  This  was  a comfortable  margin,  even  if  the  return 
time  could  not  be  reduced  below  155  hours. 

The  flight  controllers  provided  the  crew  with  a list  of  specific- 
switches  to  close  and  circuit  breakers  to  open  which  would  reduce  the 
electrical  load  to  the  minimum  possible  consistent  with  safe  operation. 

The  fact  that  virtually  all  of  the  onboard  displays  were  turned  off  is 
an  indication  of  how  extensively  the  spacecraft  was  powered  down.  Mission 
Control  kept  an  accurate  account  of  the  switch  and  circuit  breaker  con- 
figuration, and  was  able  to  insure  that  the  necessary  equipment  was  powered 
up  again  when  the  subsequent  trajectory  maneuvers  were  made.  The  full 
powerdown  configuration  actually  required  only  12  amperes,  instead  oi  1/. 
The  basis  for  this  powerdown  was  contained  in  the  LM  Contingency  Checklist 
(ref.  7).  The  Emergency  Powerdown  Checklist  was  developed  for  the  case  of 
the  LM  in  lunar  orbit  awaiting  rescue  by  the  CSM.  Some  additions  to  this 
listing  of  turned-off  equipment  were  made  by  Mission  Control. 

As  soon  as  the  electrical  power  system  configuration  was  established 
and  apparently  performing  well.  Mission  Control  began  planning  for  what 
actions  to  take  if  a LM  battery  failure  were  to  occur.  These  plans 
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included  listing  the  few  remaining  items  of  equipment  which  could  be 
taken  off  line  in  the  powered-down  condition.  Since  the  current  was 
already  down  to  less  than  17  amperes,  there  was  not  much  left  that  could 
be  removed  except  the  communications  equipment,  but  certain  equipment 
could  have  been  operated  on  a periodic. basis  rather  than  continuously. 

A schedule  for  this  kind  of  operation  was  planned  in  case  it  became 
necessary. 

At  97:14:26  the  LMP  called  Mission  Control  to  report  an  anomaly 
that  he  had  observed  in  the  LM.  This  anomaly  was  a "little  thump"  that 
was  heard  but  not  felt,  and  it  seemed  to  come  from  the  vicinity  of  the 
LM  descent  stage.  The  LMP  also  observed  a "new  shower  of  snowflakes 
come  up  that  looked  like  they  were  emitted  from  down  that  way."  The 
venting  appeared  to  be  going  radially  outward,  perpendicular  to  the 
X-axis  in  the  +Y,  +Z  quadrant,  and  it  continued  for  approximately  2 min- 
utes. Neither  the  flight  controllers  nor  the  LMP  observed  any  anomalous 
behavior  in  the  data.  The  LMP  closed  the  essential  display  circuit 
breakers  in  order  to  scan  his  instruments.  The  flight  controllers 
searched  the  various  displays  of  telemetry  data.  Since  no  unusual  read- 
ings were  noted,  the  investigation  of  the  "thump"  incident  was  not  pur- 
sued further  at  that  time.  A postflight  review  of  the  data  indicates 
that  at  about  the  time  of  the  "thump,"  a large,  momentary  increase  in 
LM  battery  output  occurred.  The  surge  was  of  2 to  3 seconds  duration, 
and  was  experienced  by  all  four  descent  batteries.  The  behavior  of 
the  four  battery  currents  is  summarized  in  the  table: 


Current  output,  amps 

Battery 

Be fore 
surge 

Peak 

After 

surge 

1 

3 

37-5 

3 

2 

2 

Off-scale 
high  60  amps 

6 

5 

3 

36.8 

1 

4 

3 

30.5 

1 

The  MSC  investigation  of  this  anomaly  is  still  in  progress,  and  the 
exact  cause  of  the  current  increase,  the  "thump,"  and  the  venting  is 
not  known.  It  does  appear  that  they  were  all  related,  but  not  connected 
with  the  previous  service  module  failure. 

At  99:51  g.e.t.  a descent  battery  no.  2 malfunction  warning  light 
illuminated.  Because  the  display  system  on  board  was  powered  down  except 
for  the  caution  and  warning  panels,  the  analysis  of  the  problem  was  done 
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in  Mission  Control  where  telemetry  was  available.  There  were  three 
possible  valid  causes  of  the  warning  light:  an  overcurrent,  a reverse 

current,  or  a battery  over temperature  condition.  The  troubleshooting 
systematically  eliminated  all  three,  and  Mission  Control  concluded  the 
problem  was  a faulty  temperature  sensor.  The  crew  was  advised  to  recon- 
nect the  battery  about  an  hour  later.  No  problems  with  the  battery  ever 
developed,  but  the  sensor  indication  later  became  erratic,  causing  several 
MC&W  alarms.  A plot  of  total  usable  amp-hours  remaining  in  the  LM 
batteries  is  contained  in  figure  B6-4. 

Coolant  system:  It  was  as  essential  to  power  down  the  LM  as  much  as 
possible  in  order  to  reduce  the  cooling  requirements  as  it  was  to  reduce 
the  battery  amp-hours  expended.  The  LM  coolant  loop  uses  the  action  of 
ice  sublimination  to  take  heat  away  from  the  spacecraft.  Feed  water  for 
the  sublimator  is  stored  in  tanks,  and  the  rate  of  water  usage  to  provide 
this  cooling  is  proportional  to  the  amount  of  electrical  power  expended 
because  of  the  heat  generated.  The  analysis  showed  that  for  the  above- 
mentioned  electrical  power  requirements,  the  LM  water  supply  was  most 
critical  and  would  be  depleted  about  155  hours  g.e.t.  This  analysis  was 
based  on  data  obtained  several  hours  after  the  initial  LM  activation. 
Estimates  based  on  the  usage  rate  immediately  after  activation  indicated 
the  LM  would  be  depleted  of  water  by  94  hours  g.e.t.  As  expected,  the 
rate  reduced  drastically,  however,  after  the  initial  cooling  down  was 
accomplished. 

During  the  mission  period  before  the  postpericynthion  abort,  when 
the  spacecraft  was  on  a trajectory  with  a 155-hour  g.e.t.  landing  time, 
efforts  were  made  to  find  a method  of  increasing  the  LM  water  margin  by 
means  other  than  a further  powerdown.  Two  procedures  were  developed  as 
a result  of  this  effort.  The  first  allowed  the  crew  to  get  drinking  water 
from  the  CM  potable  water  tank,  and  the  second  was  a method  of  trans- 
ferring water  to  the  LM  tanks  for  use  in  the  LM  coolant  loop.  The  latter 
procedure  involved  the  use  of  the  portable  life  support  systems  (PLSS) 
water  tanks  as  an  intermediate  container  for  transporting  the  water  from 
the  CM  waste  tank.  Although  it  did  not  become  necessary  to  use  the 
second  procedure,  it  was  tested  on  the  ground  by  engineering  personnel 
at  MSC,  and  was  available  in  Mission  Control.  A plot  of  the  usable  water 
remaining  in  the  LM  is  shown  in  figure  B6-5- 

Oxygen  supply  and  carbon  dioxide  removal:  The  oxygen  supply  in  the 

LM  was  adequate  for  more  than  200  hours  g.e.t.,  and  was  of  no  concern 
(fig.  B6-6) . This  included  a supply  in  the  systems  normally  used  for  the 
lunar  extravehicular  activity  (EVA) . The  initial  problem  with  the  ascent 
oxygen  tank  2 had  stabilized  to  the  condition  that  the  pressure  in  the 
tank  was  about  100  psi  above  the  normal  operating  range.  Engineering 
support  personnel  had  advised  Mission  Control  that  this  was  no  problem, 
and  no  further  actions  were  taken  in  this  area. 
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Figure  Electrical  power  system  consumables  status 
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Figure  B6-5 Usable  remaining  water 
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Figure  B6-6.-  Usable  remaining  oxygen. 


The  problem  of  removing  carbon  dioxide  from  the  cabin  oxygen  was 
a serious  one.  The  LM,  like  the  CSM,  uses  lithium  hydroxide  (LiOH) 
cartridges  to  scrub  the  recirculated  oxygen  to  remove  odors  and  carbon 
dioxide.  The  LiOH  cartridges  are  rated  for  a specified  total  man-hours 
capacity,  and  eventually  must  be  replaced  when  they  become  saturated. 

The  LM  cartridges  were  not  adequate  for  carbon  dioxide  removal  for 
three  men  for  the  duration  of  the  Earth-return  trip.  There  were  more 
than  adequate  cartridges  in  the  CM,  but  they  would  not  fit  in  the  LM 
canisters.  There  were  several  methods  suggested  for  solving  the 
problem,  including  powering  up  the  CM  system  to  circulate  cabin  oxygen 
through  its  LiOH  canisters.  The  method  that  was  actually  used  was 
developed  by  Crew  Systems  Division  personnel  at  MSC.  It  consisted  of 
using  tape,  flight  data  file  cards,  and  plastic  bag  material  to  connect 
the  CM  LiOH  canisters  to  the  LM  oxygen  circulation  system.  The  crew 
implemented  the  modification  and  it  worked  very  well.  The  partial 
pressure  of  carbon  dioxide  reading  indicated  by  the  onboard  gage  dropped 
rapidly  from  8mm  Hg  to  0.1mm  Hg  soon  after  the  rig  was  completed  at  9^- 
hours  g.e.t.  The  modification  was  not  tried  until  this  time  in  order 
to  get  maximum  use  from  the  LM  cartridges.  About  20  hours  later,  the 
carbon  dioxide  partial  pressure  reading  had  increased  to  1.8mm  Hg,  and 
a procedure  for  putting  two  additional  cartridges  in  series  to  those  in 
the  CM  canisters  was  given  to  the  crew.  This  procedure  was  also 
developed  by  engineers  at  MSC  (fig.  B6-7).  After  this  second  modifica- 
tion was  completed,  the  carbon  dioxide  partial  pressure  remained  below 
2mm  Hg  for  the  rest  of  the  mission,  without  any  further  modifications 
necessary. 

The  modifications  to  the  oxygen  circulation  systems  were  evaluated 
in  the  simulators  at  MSC  before  they  were  accepted  by  mission  operations 
personnel.  This  included  tests  in  the  pressure  chamber.  As  mentioned 
earlier,  there  were  other  methods  that  could  have  been  adopted  had  this 
one  proved  to  be  unacceptable . 

Reaction  control  system:  The  LM  reaction  control  system  (LMRCS) 

propellants  were  another  consumable  that  had  to  be  managed  carefully. 
Maintaining  attitude  control  of  both  the  CSM  and  the  LM,  with  a total 
weight  in  excess  of  90? 000  pounds,  can  be  done  by  the  LMRCS,  but  is  a 
particularly  taxing  job.  The  LM  control  system  was  not  designed  to 
perform  this  task,  and  does  not  do  it  efficiently  in  terms  of  propellant 
expenditure.  This  was  aggravated  by  the  fact  that  there  is  some  control 
moment  loss  and  some  cross  coupling  when  the  LM  Is  In  control  due  to 
thrust  plume  deflectors  designed  to  protect  the  LM  descent  stage  from 
extended  thruster  firings. 

Shortly  after  the  LM  assumed  attitude  control,  Mission  Control  gave 
the  crew  a procedure  which  increased  the  attitude  excursion  tolerance 
in  the  computer.  This  increased  the  attitude  error  tolerance  and  caused 
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Figure  B6-7--  View  of  CM  Li OH  cannister  modification  as 
installed  in  the  IM. 
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less  thruster  firings  to  be  commanded  by  the  computer  which  was  maintain- 
ing automatic  attitude  control.  The  simulators  at  KSC  and  MSG  were  used 
to  evaluate  different  techniques  for  maneuvering  the  spacecraft  under 
manual  control  as  well  as  automatic.  Manual  maneuvers  became  necessary 
after  the  LM  inertial  platform  and  computer  were  powered  down  after  the 
post-pericynthion  abort  maneuver.  Backup  and  support  crews  performed 
the  evaluations  and  recommended  certain  techniques. 

Mission  Control  kept  a close  watch  on  the  RCS  propellant  consumption 
and  was  prepared  to  have  the  crew  revert  to  an  uncontrolled,  drifting 
flight  mode  if  necessary.  This  would  have  been  requested  if  the  RCS 
propellant  decreased  below  the  "red  line"  value.  The  flight  controllers 
had  computed  a "red  line"  which  provided  enough  propellant  for  meeting 
the  midcourse  correction  maneuver  requirements  and  the  requirements  to 
maneuver  in  preparation  for  the  reentry  sequence. 

Command  service  module.-  After  the  CM  powerdown  at  58:40  there  was 
very  little  system  management  that  could  be  or  needed  to  be  done.  The 
electrical  power  system,  however,  did  require  some  attention.  The  first 
action  was  to  get  the  CM  into  a known  configuration.  So  much  had  hap- 
pened so  quickly  during  the  period  following  the  accident,  that  neither 
the  crew  nor  Mission  Control  had  a complete  knowledge  of  the  switch  con- 
figuration in  the  CM.  Therefore,  a checklist  was  developed  which  listed 
the  desired  position  of  every  switch,  circuit  breaker,  and  actuator  han- 
dle in  the  spacecraft.  The  lift-off  configuration  in  the  CSM  launch 
checklist  portion  of  the  Flight  Data  File  served  as  the  baseline  for  this 
list,  and  the  modifications  were  read  to  the  crew.  The  crew  then  config- 
ured the  CM  as  defined  by  this  list. 

The  next  task  was  to  determine  the  status  of  main  dc  bus  B. 

Because  power  had  not  been  applied  to  the  bus  since  the  failure  of  fuel 
cell  5 at  55:58,  it  was  not  certain  that  a major  short  did  not  exist 
on  it.  Mission  Control  defined  a procedure  which  used  entry  battery  B 
to  apply  power  to  the  bus.  The  procedure  contained  12  steps,  and  the 
displays  the  crew  should  monitor  were  defined,  along  with  the  expected 
indications.  The  baseline  configuration  described  in  the  preceding 
paragraph  insured  that  all  loads  were  isolated  from  the  bus.  The  proced- 
ure was  implemented  at  94:21  hours  and  verified  that  there  were  no  shorts 
on  the  bus . 

After  the  CM  had  been  powered  down  for  about  24  hours,  it  began  to 
cool  down  to  a temperature  well  below  the  minimum  expected  operating 
temperatures.  Engineering  support  personnel  became  concerned  about  the 
motor  switches  which  are  normally  used  to  connect  the  battery  busses  to 
the  main  dc  busses.  When  it  was  realized  that  the  CM  was  going  to  get 
unusually  cold  before  the  initiation  of  the  entry  sequence,  the  ability 
of  the  batteries  to  provide  sufficient  potential  to  drive  these  switches 
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was  questioned.  The  analysis  of  the  situation  was  difficult  because  of 
the  uncertainty  as  to  how  cold  the  battery  compartment  would  get,  and  it 
could  not  be  proven  that  a problem  would  exist.  However,  to  circumvent 
the  situation,  it  was  decided  to  close  the  bus  tie  motor  switches  after 
the  main  bus  B checkout.  Subsequently,  the  appropriate  circuit  breakers 
would  have  to  be  used  as  switches  to  connect  and  disconnect  the  batteries 
from  the  busses  (fig.  B6-8).  A step-by-step  procedure  was  defined  and 
read  to  the  crew  and  the  bus  tie  switches  were  closed  at  94:21  g.e.t. 

A procedure  was  also  developed  for  charging  the  CM  entry  batteries 
with  the  LM  electrical  power  system.  Approximately  20  amp-hours  of  the 
40  amp-hours  capacity  had  been  used  from  entry  battery  A during  the 
period  immediately  following  the  accident;  a much  smaller  amount  had 
been  taken  from  battery  B since  that  time.  Since  the  LM  battery  capacity 
provided  a comfortable  power  margin  for  the  return  to  Earth,  Mission 
Control  decided  to  invest  some  of  that  power  in  charging  the  CM  batteries. 
Preliminary  examinations  of  an  entry  preparation  sequence  indicated  that 
in  order  to  not  rush  the  crew,  the  CM  powerup  should  be  initiated  about 
6 hours  before  entry.  To  do  this  demanded  that  all  three  CM  batteries 
be  fully  charged.  The  procedure  to  charge  the  CM  batteries  was  defined 
in  complete  detail  by  Mission  Control.  In  its  most  basic  terms,  it  was 
simply  a procedure  that  used  the  LM/CM  electrical  umbilical  to  get 
power  to  the  CM  main  bus  B.  Then  the  CM  battery  charger  was  tied  to 
this  bus  and  the  battery  to  be  charged.  The  procedure  as  read  to  the 
crew  consisted  of  four  typewritten  pages  of  notes  and  a step-by-step 
switch  position  definition.  The  battery  charging  was  initiated  at 
about  112  hours  g.e.t.  to  demonstrate  that  it  could  be  done  and  was 
completed  at  128  hours  after  18  of  the  20  amp-hours  had  been  replaced. 

This  was  done  well  before  the  reentry  preparation,  to  allow  the  entry 
planning  to  proceed  with  the  assurance  that  all  batteries  would  be 
fully  charged  at  the  beginning  of  the  entry  preparations. 

Return  to  Earth  Trajectory  Control 

All  trajectory  determination  and  maneuver  targeting  for  getting 
the  crew  back  to  Earth  was  performed  by  the  Mission  Control  Center.  This 
is  the  normal  procedure,  but  usually  the  crew  also  has  the  capability  to 
do  this.  This  serves  as  a backup  in  case  communications  are  lost  with 
the  ground.  However,  with  the  command  module  G&N  system  completely 
shut  down,  the  crew  was  totally  dependent  on  Mission  Control  for  naviga- 
tion, and  abort  and  midcourse  correction  maneuver  targeting.  There  was 
no  backup. 

There  were  four  trajectory  change  maneuvers  performed  to  return 
the  spacecraft  to  the  recovery  area  in  the  mid-Pacific  Ocean  following 
the  command  module  powerdown  (fig.  B6-9).  The  first,  performed  at 
6l:J0  g.e.t.,  placed  the  spacecraft  on  a safe  reentry  trajectory.  The 
second,  performed  at  79:28  g.e.t.,  adjusted  the  Earth  landing  point  to 
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Figure  B6-8.-  Simplified  wiring  diagram  showing  battery 
power  to  main  busses. 
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the  mid-Pacific  recovery  area.  The  last  two  maneuvers,  performed  at 
105:18  and  at  137:40  g.e.t.,  were  course  corrections  which  adjusted  the 
entry  conditions  to  be  in  the  middle  of  the  safe  entry  corridor.  These 
maneuvers  and  the  decisions  related  to  the  choice  of  specific  course 
changes  are  described  in  the  following  paragraphs. 

Abort  maneuver  at  6l:50  hours.-  Soon  after  the  failure  in  the  CSM 
it  became  obvious  that  the  lunar  landing  mission  could  not  be  achieved 
and  that  all  effort  would  have  to  be  focused  on  getting  the  crew  back 
to  Earth  as  soon  as  possible.  At  the  time,  the  spacecraft  was  not  on  a 
trajectory  that  would  return  to  a safe  reentry  of  the  Earth's  atmosphere 
--so  a trajectory  change  was  mandatory.  The  following  questions  needed 
to  be  answered:  What  path  should  be  followed  back  to  Earth?  When 

should  the  trajectory-changing  maneuver  be  executed? 

Because  the  spacecraft  was  on  its  way  to  the  Moon,  there  were  two 
basic  types  of  abort  paths  that  could  have  been  followed:  (l)  a direct 

abort  in  which  the  trajectory  would  be  turned  around  and  the  spacecraft 
returned  to  Earth  without  circumnavigating  the  Moon;  and  (2)  a circum- 
lunar  abort  in  which  the  spacecraft  would  follow  a path  around  the  Moon 
before  it  returned  to  Earth.  The  disadvantage  of  the  circumlunar  abort 
path  is  that  the  flight  back  to  Earth  takes  a longer  time  than  for  direct 
aborts.  However,  circumlunar  aborts  require  much  less  velocity  change 
and  consequently  much  less  propellant  to  perform,  and  part  of  the  flight 
time  can  be  made  up  by  executing  an  additional  "speedup”  maneuver  after 
the  spacecraft  has  passed  the  Moon. 

The  direct  abort  was  ruled  out  for  Apollo  13  because  the  propellant 
requirements  were  so  large.  It  would  have  been  necessary  to  jettison 
the  LM  in  order  to  reduce  the  spacecraft  weight  so  that  the  service 
propulsion  system  (SPS)  engine  could  make  the  necessary  velocity  change. 
The  LM  was  essential  to  the  crew's  survival,  and  must  not  be  jettisoned. 
Therefore,  the  choice  was  narrowed  to  the  circumlunar  abort  which  could 
be  executed  with  the  LM  descent  propulsion  system  (DPS),  but  there  were 
still  some  decisions  to  be  made.  The  options  were  as  follows: 

1.  Do  nothing  until  after  the  spacecraft  passed  the  Moon;  then 
execute  a maneuver  to  place  it  on  an  Earth-return  trajectory. 

2.  Execute  a maneuver  as  soon  as  practical  to  place  the  spacecraft 
on  an  Earth-return  trajectory  and  power  down  the  LM  immediately  there- 
after. 

3.  The  combination  of  both  the  above:  Get  on  an  Earth- re turn 

trajectory  as  soon  as  practical,  and  after  the  spacecraft  passed  the 
Moon,  perform  a maneuver  to  speed  up  the  return  to  Earth. 
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Option  2 was  selected.  The  principal  reason  was  that  the  LM 
systems  necessary  for  executing  the  maneuver  were  working  at  the  time, 
and  they  might  not  be  working  20  hours  from  then  when  the  spacecraft 
was  in  position  to  do  option  1.  Another  consideration  was  the  fact 
that  the  velocity  requirement  to  get  on  an  Earth-return  trajectory 
would  increase  from  40  fps  to  l60  fps , making  it  impossible  to  perform 
with  the  RCS  system  if  this  became  necessary.  So  even  though  option  1 
would  have  allowed  an  immediate  partial  LM  powerdown,  saving  some  elec- 
trical power  and  water,  it  was  decided  that  the  risk  was  not  worth  the 
savings.  Also,  option  2 left  option  3 available  if  the  guidance  and 
navigation  system  could  be  powered  up  to  perform  the  second  maneuver. 

The  decision  having  been  made  to  perform  a circumlunar  abort,  and 
to  perform  as  soon  as  possible  the  maneuver  to  place  the  spacecraft  on 
a safe  reentry  trajectory,  the  only  question  remaining  open  was  what 
Earth  landing  point  to  target  for.  Because  of  the  LM  consumables  status, 
getting  back  to  Earth  as  soon  as  possible  was  the  overriding  factor. 

The  quickest  return  resulted  in  a landing  in  the  Indian  Ocean  at  152 
hours  g.e.t.  This  meant  giving  up  the  ability  to  bring  the  spacecraft 
down  in  the  vicinity  of  the  prime  recovery  force  in  the  Pacific,  although 
at  least  a water  landing  was  provided.  This  was  considered  to  be  accept- 
able because  the  abort  maneuver  after  passing  the  Moon  probably  could 
be  used  to  decrease  the  flight  time  and  to  land  in  the  prime  recovery 
area. 


Post-peri cynthion  abort  maneuver.-  Although  the  spacecraft  was 
placed  on  a reentry  trajectory  by  the  abort  maneuver  at  6l:30  with  a 
landing  at  152  hours  g.e.t.  in  the  Indian  Ocean,  it  was  decided  that 
a post-pericynthion  abort  maneuver  (PC  + 2)  should  be  performed.  There 
were  two  reasons:  (l)  to  reduce  the  return  time  to  increase  the  LM 

consumable  margin  (the  prediction  at  the  time  indicated  only  a 3-hour 
margin);  and  (2)  to  change  the  landing  point  to  the  mid-Pacific  where 
the  recovery  force  could  be  on  station. 

During  the  first  few  hours  after  LM  activation,  detailed  analysis 
of  LM  consumable  usage  had  shown  that  the  guidance  and  navigation  system 
could  be  kept  powered  up  until  after  the  PC  + 2 abort  maneuver  at  T9 *30 
g.e.t.  It  was  predicted  that  all  consumables  would  last  at  least  until 
155  hours  g.e.t.  even  if  the  LM  powerdown  to  15  amperes  total  current 
were  delayed  until  after  80  hours  g.e.t. 

There  were  several  options  available  for  decreasing  the  flight 
time,  but  only  the  three  listed  in  the  following  table  provided  a landing 
in  the  mid-Pacific. 
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Option 

Delta  V, 
fps 

Engine 

used 

Landing  time, 
hours  g.e.t. 

i 

850 

DPS 

142 

2 

4000 

DPS 

118 

3 

4000 

1 

i 

1 

SPS 

118 

Option  1 was  selected  even  though  it  resulted  in  the  longest  flight 
time,  because  of  some  very  undesirable  characteristics  of  options  2 and 
5-  The  problem  with  option  2 was  that  it  would  be  necessary  to  jettison 
the  service  module  in  order  to  be  able  to  get  a 4000  fps  velocity  change 
with  the  LM  descent  propulsion  system.  Such  a maneuver  would  almost 
deplete  the  descent  propellant,  leaving  a very  limited  capability  should 
subsequent  maneuvers  be  necessary.  There  was  a high  probability  that  a 
large  course  correction  would  have  to  be  made  later.  Option  2 was 
seriously  considered,  but  eventually  rejected  because  it  left  the  CM 
heat  shield  exposed  to  the  space  environment  for  such  a long  period  of 
time,  and  the  possible  thermal  degradation  that  might  result  from  this 
was  an  unknown  risk.  The  heatshield  capability  to  withstand  reentry 
might  be  compromised  by  the  prolonged  period  of  cold  temperature  it 
would  experience.  Option  5 was  rejected  because  of  the  unknown  status 
of  the  SPS;  it  was  thought  that  the  SPS  or  the  SM  might  have  been 
damaged  by  whatever  had  caused  the  "bang"  and  that  the  SPS  should  not 
be  used  unless  absolutely  necessary. 

Since  option  1 provided  a comfortable  consumables  margin  and 
allowed  retention  of  the  service  module,  it  was  selected.  Option  1 
also  allowed  a descent  propulsion  system  delta  V capability  of  approxi- 
mately 1000  fps  to  be  retained  after  the  abort  maneuver. 

Part  of  the  preparation  for  each  mission  is  the  establishment  of 
"ground  rules"  and  maneuver  monitoring  criteria  for  each  planned 
maneuver.  The  "ground  rules"  are  general  statements  which  define  what 
should  be  done  if  certain  events  occur.  The  maneuver  monitoring 
criteria  define  explicitly  the  conditions  under  which  the  crew  will 
deliberately  terminate  the  maneuver  early.  The  criteria  are  not  the 
same  for  all  maneuvers  because  there  is  a wide  variation  in  the  serious- 
ness of  the  effect  of  dispersions,  and  in  the  seriousness  of  the  effects 
of  early  or  late  engine  shutdown.  The  trajectory  and  mission  situations 
for  the  post-pericynthion  abort  burn  were  different  from  any  of  those 
for  which  criteria  had  been  defined;  therefore,  it  was  necessary  to 
establish  these  "rules." 
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The  pertinent  characteristics  that  would  affect  the  rules  were  as 
follows : 

(a)  The  spacecraft  was  on  a safe  reentry  trajectory,  although 
small  course  corrections  probably  would  be  required  before  reentry. 

(b)  The  primary  purpose  of  the  maneuver  was  to  place  the  landing 
point  in  the  vicinity  of  the  recovery  force. 

(c)  The  secondary  purpose  of  decreasing  the  flight  time  was  of 
ma j or  importance . 

(d)  The  LM  inertial  platform  had  not  been  fine  aligned  for 
approximately  20  hours . 

(e)  The  maneuver  could  be  delayed  for  2 hours  with  an  increase  in 
delta  V of  only  24  fps. 

(f)  The  LM  descent  propulsion  system  was  to  be  used. 

The  following  ground  rules  based  on  these  characteristics  were 
established  by  the  Mission  Control  team  and  were  given  to  the  crew: 

(a)  If  the  engine  does  not  light,  do  not  attempt  any  emergency 
start  procedures. 

(b)  If  the  primary  guidance  and  navigation  system  (PGNS)  has 
failed,  do  not  perform  the  maneuver. 

(c)  Do  not  attempt  to  null  the  indicated  velocity  errors  after 
engine  shutdown. 

(d)  If  an  engine  shutdown  occurred,  a subsequent  midcourse  correc- 
tion would  be  performed  no  sooner  than  2 hours  later. 

The  criteria  for  early  termination  of  the  maneuver  were  defined  as 
follows : 

1*  Propulsion  System  Parameters 

(a)  Engine  chamber  pressure 


(b )  Inle  t pre  s sure 


(c)  Delta  P fuel/oxidizer 


<85  psi  (TM) 

^77  percent  thrust  (on  board) 
<150  psi  (TM) 

<l6o  psi  (on  board) 

>25  psi  (ground  monitored) 
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2.  Guidance  and  Control  System  Parameters 

(a)  Attitude  rate  >10  deg/sec  (except  during  start 

transient) 

(b)  Attitude  error  >10  degrees 

(c)  Engine  gimbal  light 

(d)  Inertial  platform  failure  with  a program  alarm 

(e)  Computer  warning  light 

(f)  Control  electronics  system  dc  fail  light 

A final  rule  that  was  defined  stated  that  if  an  early  engine  shutdown 
was  experienced  not  due  to  any  of  the  above,  a relight  should  be 
attempted,  using  the  engine-start  pushbutton  and  the  Descent  Engine 
Command  Override  switch. 

A contingency  LM  activation  checklist  had  been  defined  prior  to 
the  mission  and  was  part  of  the  crew's  Flight  Data  File.  This  checklist 
was  designed  to  prepare  the  LM  for  a docked  descent  propulsion  system 
burn  from  a completely  dormant  state.  The  majority  of  this  checklist 
had  been  accomplished  with  the  initial  LM  powerup  at  58  hours  g.e.t. 

The  flight  controllers  reviewed  the  list  in  detail  and  defined  a modi- 
fied list  of  steps  necessary  to  prepare  the  LM  for  the  abort  maneuver. 

The  modification  was  basically  a deletion  of  steps  already  accomplished 
or  not  necessary;  however,  there  was  one  change  which  revised  the  time 
at  which  the  helium  regulator  shutoff  valve  was  to  be  closed.  This  was 
done  to  preclude  the  possibility  of  a shift  in  the  regulator  operating 
pressure  causing  a freezing  of  the  propellant  lines  after  this  burn. 

Such  an  event  would  prevent  further  use  of  the  descent  engine  and  it  was 
mandatory  to  maintain  this  engine  for  probable  subsequent  trajectory 
changes . 

Midcourse  correction  maneuver.-  Postmaneuver  tracking  data  indicated 
that  the  second  abort  maneuver  had  placed  the  spacecraft  grossly  on  the 
right  path.  However,  because  the  LM  inertial  platform  could  not  be  fine 
aligned  prior  to  the  maneuver,  the  execution  errors  were  larger  than 
normal  and  the  spacecraft  was  not  on  a safe  reentry  trajectory.  This 
was  expected  and  subsequent  corrections  were  planned  for  in  the  LM 
consumables  budget.  The  correction  delta  V magnitude  was  projected  to 
be  about  7 fps  if  executed  at  104  hours  g.e.t.  Unlike  the  abort  maneuver, 
the  course  correction  maneuvers  are  not  extremely  sensitive  to  pointing 
accuracy,  and  with  the  delta  V of  only  7 fps  it  could  probably  be  executed 
with  sufficient  accuracy  without  the  inertial  guidance  system.  A special 
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team,  composed  of  off-duty  flight  controllers  and  members  of  the  backup 
flightcrew,  was  formed  to  define  the  maneuver  ground  rules  and  procedures 
to  be  followed  for  the  course  correction  maneuver.  A detailed  crew 
checklist  was  to  be  developed  also.  None  of  the  procedures  or  checklists 
in  the  Flight  Data  File  were  applicable  because  of  the  unique  situation 
that  existed  for  this  case. 

The  major  issues  addressed  by  this  team  were  as  follows: 

1.  How  to  get  the  spacecraft  aligned  in  the  proper  direction  for 
the  maneuver?  Was  it  necessary  to  power  up  the  inertial  platform? 

2.  Which  engine  should  be  used,  descent  propulsion  system  or  LM 

RCS? 

J.  What  burn  monitoring  criteria  should  be  used? 

4.  What  attitude  control  modes  should  be  used? 

The  team  determined  that  it  was  unnecessary  to  use  the  inertial 
platform  for  the  maneuver.  The  spacecraft  could  be  oriented  in  the 
proper  pitch  direction  by  sighting  on  the  center  of  the  Earth  with  the 
Crew  Optical  Alignment  System  (COAS)  fixed  along  the  LM  +Z  axis.  The 
approximately  correct  azimuth  could  be  achieved  by  aligning  the  sunset 
terminator  parallel  to  the  LM  Y-axis.  This  procedure  had  been  developed 
in  the  preparation  for  Apollo  8 when  it  was  discovered  that  course 
correction  maneuvers  could  best  be  made  in  a local  horizontal  attitude 
(that  is,  perpendicular  to  a vector  from  the  center  of  the  Earth  to  the 
spacecraft).  It  could  easily  be  applied  to  the  LM-active  maneuver,  and 
would  give  adequate  thrust  pointing  accuracy,  so  it  was  not  necessary 
to  power  up  the  LM  G&N  system  and  try  to  align  its  inertial  platform. 

It  was  decided  to  use  the  descent  propulsion  system  for  the  maneuver 
instead  of  the  RCS  engines,  because  the  engine-on  time  for  an  RCS  maneuver 
would  exceed  a constraint  which  protects  the  LM  RCS  plume  deflectors. 

The  engine  was  to  be  left  at  the  low  throttle  point  (about  12.6  percent 
of  full  thrust)  to  give  the  crew  more  time  to  monitor  the  burn  and  the 
lower  acceleration  should  increase  the  shutdown  accuracy.  The  engine 
shutdown  criteria  were  the  same  as  for  the  previous  burn.  It  was 
decided  to  monitor  the  delta  V with  the  backup  guidance  system  acceler- 
ometers, but  to  shut  the  engine  down  at  a fixed  delta  time  specified  by 
Mission  Control.  Studies  had  shown  that  the  burn  time  computed  by 
Mission  Control  was  very  accurate.  Since  the  accelerometers  had  not 
been  maintained  at  their  proper  temperature  (heaters  had  been  turned  off 
to  reduce  consumables  expenditure),  their  status  was  questionable  and 
the  team  decided  to  not  use  the  backup  guidance  system  as  an  engine 
shutdown  cue.  However,  if  this  system  appeared  to  perform  nominally 
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during  the  maneuver,  it  would  be  used  to  null  the  velocity  residuals  in 
the  X direction.  Velocity  errors  in  either  Y or  Z direction  had  an 
insignificant  effect  on  the  entry  conditions  and  were  not  to  be  nulled. 

Attitude  control  of  the  docked  vehicle  with  the  backup  system 
required  both  the  CDR  and  the  LMP  to  actively  participate,  and  Y-  and  Z- 
axis  translation  thrusters  had  to  be  used  to  get  adequate  control  torque. 
The  team  defined  the  modes  and  procedures  to  be  used  in  getting  the 
spacecraft  in  the  correct  attitude  and  in  controlling  the  attitude  during 
the  engine  burn.  A procedure  to  return  the  spacecraft  to  the  passive 
thermal  control  condition  was  also  defined. 

All  plans  were  completed  after  two  lengthy  sessions.  A subgroup 
from  the  team  defined  a detailed  crew  checklist  to  be  followed  in 
preparing  for  the  maneuver  and  in  preparing  for  the  coasting  flight 
following  the  maneuver.  The  checklist  was  evaluated  by  members  of  the 
backup  crew  in  mission  simulators  at  MSC  and  some  minor  modifications 
were  made  as  a result.  The  checklist  and  the  procedures  were  reviewed 
by  the  on-duty  Mission  Control  team  and  then  read  to  the  crew  approxi- 
mately 5 hours  prior  to  the  scheduled  course  correction.  This  allowed 
the  crew  ample  time  to  study  them  and  to  rehearse  their  roles. 

Entry  Procedures  and  Checklist  Definition 

After  the  situation  in  the  spacecraft  was  stabilized,  one  of  the 
several  parallel  activities  that  was  initiated  was  the  definition  of 
procedures  for  the  pre-reentry  phase.  The  total  loss  of  electrical 
power  in  the  service  module  forced  some  major  revisions  to  the  activities 
and  the  crew  procedures  for  this  part  of  the  mission.  The  most  signifi- 
cant consequences  of  this  loss  were  the  following:  (l)  SM  PCS  engines 

would  not  continue  to  fire  to  separate  it  from  the  CM  after  jettison; 
and  (2)  LM  electrical  power  and  RCS  should  be  used  to  conserve  the  CM 
batteries  and  RCS  propellant  as  much  as  possible.  This  meant  that  the 
LM  should  be  retained  through  as  much  of  the  pre -entry  sequence  as 
possible,  and  that  a plan  for  jettisoning  the  SM  and  the  LM  had  to  be 
worked  out. 

A first  iteration  plan  for  the  pre-entry  phase  was  available  as 
early  as  12  hours  after  the  LM  activation.  This  plan  called  for  CM 
powerup  2 hours  before  arrival  at  the  entry  interface  (El  - 2 hours), 
and  required  the  total  remaining  capacity  from  the  CM  entry  batteries, 

98  amp-hours.  After  the  plan  was  thoroughly  reviewed  by  all  elements 
of  the  operations  team,  including  mission  planning  and  flight  crew 
support  personnel,  several  modifications  and  additions  were  considered 
necessary.  The  principal  difficulty  was  that  the  crew  would  probably 
be  rushed,  and  there  was  little  or  no  extra  time  allowed  for  contingen- 
cies. It  was  evident  that  the  timeline  needed  to  be  extended  and  the  CM 
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batteries  would  have  to  be  recharged  to  at  least  115  amp-hours.  The 
recharging  was  accomplished  and  the  procedure  is  described  in  Part  A2 
of  Appendix  A. 

The  White  Team,  one  of  the  four  flight  control  teams  assigned  to 
the  mission,  was  taken  off  its  normal  rotation  of  duty  in  order  to 
devote  full  attention  to  developing  the  reentry  preparation  sequence 
of  events,  crew  procedures,  and  checklists.  With  this  flight  control 
team  as  the  lead  element,  all  MSC  organizations  normally  involved  in 
this  type  of  premission  activity  were  enlisted  in  this  effort.  In  the 
course  of  defining  the  procedures,  extensive  use  was  made  of  the  space- 
craft simulators  at  MSC  and  KSC.  These  simulations,  performed  by  members 
of  the  backup  crews,  served  two  essential  purposes.  The  first  was 
simply  to  evaluate  them-- to  determine  if  they  were  practical,  safe, 
efficient,  and  adequate.  The  second  purpose  was  to  determine  the  time 
required  to  complete  certain  parts  of  the  procedures.  The  latter  was 
important  because  a completely  defined  timeline  had  to  be  given  to  the 
crew  in  order  to  insure  that  everything  was  accomplished  on  time.  It 
was  essential  that  this  timeline  be  realistic  because  the  crew  could 
not  afford  to  get  behind  and  fail  to  complete  it,  but  neither  could 
they  start  too  early  and  use  too  much  power  from  the  CM  batteries. 

Another  source  of  data  used  to  develop  the  procedures  was  a series 
of  contingency  separation  studies  that  was  performed  prior  to  the  flight 
by  mission  planning  personnel.  These  studies  had  examined  the  trajectory- 
related  considerations  for  several  different  methods  of  jettisoning  the 
SM  and  the  LM.  They  had  defined  the  effects  of  different  attitudes, 
time,  and  velocity  of  jettison  on  the  subsequent  separation  distances. 

It  was  only  necessary  to  verify  that  these  studies  were  valid  for  the 
Apollo  13  conditions,  and  then  select  the  one  with  the  most  optimum 
characteristics . 

The  planning  and  evaluation  of  the  pre-entry  activities  continued 
for  approximately  2 days.  At  the  end  of  this  time,  a complete  plan 
had  been  defined  and  thoroughly  reviewed.  It  was  read  to  the  crew  at 
about  120  hours  g.e.t.,  which  gave  them  about  a day  to  study  and  rehearse 
their  procedures. 

The  pre-entry  sequence  plan  (fig.  B6-10)  called  for  initiating  the 
powerup  at  El  - 6 hours,  with  the  LM  supplying  power  to  main  bus  B in 
the  CM  and  entry  battery  C supplying  power  to  main  bus  A.  A total  of 
115  amp-hours  was  required  of  the  CM  entry  batteries,  including  a 23  amp- 
hour  allowance  for  contingency  after  splashdown.  A detailed  expected 
battery  current  profile  was  plotted  and  used  during  the  actual  prepara- 
tion to  verify  that  a safe  power  margin  was  maintained  throughout  the 
reentry  preparations.  Battery  utilization  was  planned  so  that  all 
three  entry  batteries  would  be  available  throughout  the  entry  phase.  It 
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was  predicted  that  battery  C would  be  depleted  after  deployment  of  the 
main  chutes,  and  in  fact  it  was.  This  left  the  redundant  capability  of 
two  batteries  available  to  inflate  the  upright ing  bags  after  splashdown. 

The  initial  part  of  the  reentry  preparations,  LM  powerup,  was 
performed  about  3 hours  earlier  than  planned.  The  crew  was  not  resting 
comfortably  due  to  the  cold  environment,  and  since  there  was  ample 
margin  in  the  LM  batteries  and  water  tanks,  it  was  decided  to  turn  on 
some  equipment  to  try  to  warm  up  the  spacecraft. 

After  activating  the  LM  guidance  and  control  system,  the  first 
major  milestone  in  the  entry  sequence  was  to  execute  the  final  course 
correction  to  place  the  spacecraft  on  a trajectory  that  was  in  the  center 
of  the  safe  entry  corridor.  Prior  to  the  final  course  correction,  the 
trajectory  had  an  entry  angle  error  of  about  +0.5  degree,  which  is  a 
safe  condition,  but  slightly  shallow  (fig.  B6-II).  It  is  a standard 
practice  to  perform  a final  trim  maneuver  a few  hours  prior  to  entry  to 
try  to  remove  any  entry  angle  error  greater  than  ±0.1  degree,  and  this 
course  correction  was  incorporated  in  the  timeline  before  it  was  known 
whether  or  not  it  could  be  required. 

The  planned  procedures  for  the  final  course  correction  were  the 
same  as  for  the  earlier  one  performed  at  about  104  hours  g.e.t., 
including  the  alignment  procedure  which  only  required  sighting  the 
Earth  through  the  COAS.  Manual  control  of  the  actual  delta  V maneuver 
was  also  planned.  However,  since  the  LM  powerup  was  started  3 hours 
earlier  than  originally  expected,  it  was  decided  to  use  part  of  this 
time  to  align  the  LM  inertial  platform.  This  was  done  with  the  crew 
sighting  on  the  Moon  and  the  Sun  for  orientation  determination.  A 
further  modification  to  the  planned  procedures  of  using  the  primary 
guidance  system  to  perform  the  course  correction  had  to  be  abandoned, 
because  the  attitude  error  indications  did  not  behave  properly.  It  was 
suspected  that  there  might  be  something  wrong  with  the  guidance  computer, 
so  the  crew  performed  the  maneuver  manually,  following  the  original  plan. 
Subsequent  analysis  has  shown  that  the  attitude  error  indications  were 
not  indicative  of  a system  problem,  but  were  a result  of  the  guidance 
system  activation  procedures.  These  same  indications  did  not  show  up 
in  the  simulator  evaluations  performed  before  the  crew  was  given  the 
procedures  because  of  the  limitations  of  simulator  initialization. 

The  service  module  jettison  was  the  next  major  milestone  in  the 
pre-entry  sequence.  It  was  performed  at  about  4-1/2  hours  prior  to 
reentry.  The  techniques  used  and  the  attitude  and  delta  V requirements 
for  it  were  obtained  from  premission  studies.  Basically,  the  technique 
was  very  similar  to  that  used  by  a railroad  switch  engine  to  get  rid  of 
the  end  boxcar.  The  spacecraft  was  given  an  impulse  with  the  LM  RCS 
that  caused  a velocity  change  in  the  desired  direction  of  about  0.5  fps; 
the  CM/SM  separation  pyrotechnics  were  fired,  physically  disconnecting 
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the  two  modules;  and  a velocity  change  of  the  LM  and  CM  was  accomplished 
by  reverse  thrust  from  the  LM  RCS.  The  service  module  continued  to 
translate  relative  to  the  manned  modules,  and  separated  from  them  at  a 
rate  of  0.5  fps.  The  normal  method  of  using  SM  RCS  jets  to  drive  the 
SM  away  would  not  work  because  there  was  no  way  to  get  electrical  power 
to  keep  the  jets  firing  after  CM/SM  separation.  The  fuel  cells  which 
normally  perform  this  function  were  inoperative. 

The  next  major  step  was  to  get  the  CM  inertial  platform  aligned. 

An  automatic  guidance  controlled  reentry  was  planned,  which  meant  that 
the  platform  needed  to  be  aligned  to  a known  reference  direction.  There 
were  several  methods  that  could  have  been  used  to  accomplish  this,  and 
a considerable  amount  of  time  was  spent  by  the  White  Team  in  determining 
the  best  one.  The  selected  plan  used  the  docked  align  transfer  proced- 
ure to  get  the  CM  platform  coarsely  aligned  to  the  LM  platform.  The  CM 
platform  was  then  very  accurately  aligned  to  the  desired  direction  by 
optical  sightings  with  the  CM  sextant.  Mission  Control  was  standing  by 
with  an  alternate  procedure  in  case  stars  could  not  be  seen  through  the 
CM  optics;  however,  this  was  not  necessary. 

There  was  much  interference  on  the  voice  and  telemetry  communica- 
tion signals  during  this  time  period,  which  was  later  diagnosed  to  be 
due  to  the  spacecraft  attitude.  Apparently  the  spacecraft  was  oriented 
so  that  the  LM  structure  was  blocking  the  signal  from  all  of  the  omni 
antennas  arrayed  around  the  CM,  and  the  received  signal  strength  was  very 
low.  The  antenna  blockage  problem  was  not  recognized  and  several  recon- 
figurations of  the  communication  equipment  were  made  to  try  to  correct 
the  problem,  none  of  which  were  successful.  In  order  to  maintain 
adequate  signal  strength,  it  was  necessary  to  receive  data  at  the  low 
bit  rate  only.  This  was  not  a major  handicap,  but  it  did  cause  some 
delay  in  completing  the  preparation  of  the  CM  guidance  system  for  reentry. 

The  LM  jettison  from  the  CM  was  accomplished  at  about  1 hour  prior 
to  reentry.  The  attitude  was  based  on  premission  studies,  but  no  tech- 
nique had  been  defined  for  achieving  the  actual  separation  with  LM 
jettison  from  the  CM  only  (no  service  module).  The  technique  was  defined 
by  the  White  Team  and  consisted  of  using  pressure  in  the  LM/CM  tunnel  to 
impart  a relative  velocity  to  the  two  modules  when  the  final  separation 
pyrotechnics  were  fired.  This  method  of  separation  had  inadvertantly 
occurred  at  the  LM  final  jettison  on  Apollo  10  and  was  known  to  give 
sufficient  separation  velocity. 

It  was  planned  to  jettison  the  LM  in  a direction  k-5  degrees  south 
of  the  spacecraft  plane  of  motion;  however,  the  crew  maneuvered  the 
spacecraft  to  an  attitude  65  degrees  north  of  this  plane.  Mission 
Control  was  monitoring  the  spacecraft  attitude,  but  did  not  realize  the 
mistake  until  the  crew  was  in  the  process  of  final  closeout  of  the  LM. 
Flight  controllers  quickly  analyzed  the  situation  and  determined  that, 
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although  the  65  degrees  north  attitude  did  not  give  as  much  separation, 
it  was  acceptable.  The  major  problem  in  being  in  error  by  110  degrees 
was  that  it  placed  the  CM  in  an  attitude  much  closer  to  gimbal  lock  than 
is  normally  done.  The  crew  had  to  be  especially  alert  during  the 
jettison  and  to  use  manual  control  of  the  CM  to  avoid  gimbal  lock. 

The  remainder  of  the  sequence,  from  LM  jettison  to  splashdown, 
followed  normal  procedures.  The  only  difference  was  that  the  CM  was 
completely  independent  of  other  spacecraft  components  at  1 hour  prior 
to  reentry  instead  of  the  usual  15  minutes. 
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PART  B7 


INSTRUMENT  SYSTEM  CHARACTERISTICS 


Part  7 provides  additional  technical  information  of  systems  design 
and  characteristics  which  are  pertinent  to  interpretation  of  data  pre- 
sented in  earlier  parts  of  this  Appendix.  The  following  systems  are 
discussed: 

Oxygen  Tank  Temperature  Instrumentation 
Oxygen  Tank  Quantity  Instrumentation 
Oxygen  Tank  Pressure  Instrumentation 
Apollo  PCM  Telemetry  System 
Mission  Control 


OXYGEN  TANK  TEMPERATURE  MEASUREMENT 


The  temperature  measurement  is  made  with  a platinum  resistance 
thermometer  (R/T)  encased  in  an  Inconel  sheath  attached  to  the  Teflon 
insulator  part  of  the  quantity  probe  (fig.  B7-l)  • The  resistance  of 
the  R/T  and  the  transducer  output  voltage  increase  with  temperature. 

The  signal  conditioner  which  serves  as  a reference  voltage  generator 
and  amplifier  is  located  on  the  oxygen  tank  shelf.  An  electrical  sche- 
matic of  the  transducer  is  shown  In  figure  B7-2. 

The  system  electrical  and  performance  parameters  can  be  summarized 
as  follows: 


Data  sample  rate 
Range 

Corresponding  r/t  values 
Output  voltage 
Accuracy 
Output  impedance 


one  per  second 
-320°  F to  +80°  F 
71  to  553  ohms 
0 to  5 V dc 

±2.68  percent  or  ±11°  F 
5000  ohms 
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Figure  B7— 1.  - Oxygen  quantity  gage  and  temperature  sensor  location 
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Figure  B7-2.-  Oxygen  tank  temperatures  sensing  circuit. 


Power  1.25  watts,  115  V ac,  400  cps 

Time  constant  in  liquid  Approximately  20  seconds 

nitrogen  or  alcohol 

The  20- second  time  constant  was  measured  by  plunging  the  sensor 
first  into  liquid  nitrogen  at  -517°  F and  then  into  dry  ice/alcohol  at 
-91°  F.  Tests  were  made  under  one-g  and  1 atmosphere  and  are  not  appli- 
cable to  supercritical  oxygen  and  zero-g. 

Telemetry  would  indicate  the  temperature  of  the  sensor  itself,  but 
under  rapidly  changing  conditions  the  sensor  could  remain  almost  un- 
affected by  local  temperature  changes  in  other  parts  of  the  tank.  The 
effect  of  various  failure  modes  on  the  transducer  and  its  output  signal 
are  presented  in  table  B7-I. 


OXYGEN  TAM  QUANTITY  INSTRUMENTATION 


The  oxygen  tank  quantity  gage  is  shown  in  figure  B7-1.  This  gage 
senses  the  average  dielectric  constant  of  oxygen  in  the  cylindrical 
annular  volume  between  two  concentric  aluminum  tubes.  The  dielectric 
constant  is  proportional  to  density,  which  in  turn  is  proportional  to 
the  quantity  of  oxygen  in  the  tank.  The  gage  is  approximately  2 feet 
long;  the  outer  tube  is  about  0.85- inch  ID  and  the  inner  tube  is  about 
0.65-inch  0D  to  form  two  plates  of  a capacitor  with  0.10-inch  spacing. 
The  gage  mounts  in  the  center  of  the  tank. 

The  gage  capacitance  Is  connected  in  series  with  a reference 
capacity  to  form  a capacitive  400-cycle  ac  voltage  divider  as  shown  in 
figure  B7-3  and  is  adjusted  to  apply  zero  volts  Input  to  the  amplifiers 
when  the  tank  is  empty.  As  the  tank  is  filled,  the  gage  capacity  in- 
creases, applying  a voltage  to  the  amplifier  input.  This  voltage  is 
amplified  and  rectified  to  provide  an  output  signal  voltage  which 
increases  to  5 volts  dc  when  the  tank  is  full. 

The  reactive  voltage  developed  across  the  probe  capacitance  will 
change  as  rapidly  as  capacitance  changes.  The  rectifier  filter  on  the 
output  of  the  signal  conditioner  introduces  a time  constant  of  about 
0.022  second  in  the  instrument  response. 
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TABLE  B7-I.-  FAILURE  MODES  OF  THE  OXYGEN  TANK  TEMPERATURE  TRANSDUCER 


• Failure  mode 

i 

Indication 

Resulting  damage 

- 

Any  of  the  four  temperature 
sensor  leads  shorted  to  115 
V ac  line  (l,  2,  3,  U) 

Full  scale 
output  followed 
by  zero  output 

Would  fail  signal  condi- 
tioner amplifier,  sensor 
element , and  pulse  code 
modulation  gate 

- 

Temperature  sensor  shorted 
to  the  density  probe 
element 

*No  change 
in  output 

Probably  no  circuit 
element  damage 

Temperature  sensor  shorted 
to  ground  (either  side) 

*Zero  output 
signal 

No  circuit  damage 

Dc  power  shorted  to  temper- 
ature sensor 

! 

Full  scale 
output 

Would  fail  signal  condi- 
tioner output 

Either  or  both  sensor 
leads  open 

i 

Full  scale 
output 

None 

i+00  Hz  power  input 
to  power  supply  discon- 
nected. 

i 

Output  drifts 
to  zero  as 
charge  in 
power  supply 
filter  capac- 
itors dis- 
charge . 

None 

Temperature  sensor  leads 
shorted  to  each  other 

*Zero  out- 
put 

None 

Any  one  of  leads  1,  3,  or 
b broken  (open)  (fig.  B7-2) 

Zero  out- 
put 

No  circuit  damage 

Open  lead  2 (fig.  B7-l) 

1 i 

* Immediate  rise 
to  full  scale 
followed  by  a 
linear  decay 
to  zero  in 
approx.  10  msec 

No  circuit  damage 

^Indication  verified  by  test 
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Gage  parameters  are  as  follows: 


Tank  condition 

Empty 

Full 

Density 

0 

69.5  lb/ft5 

Dielectric 

Constant 

1.0 

1.45 

Capacitance 

121 

175  picofarad; 

Output  voltage 

0 

5 V dc 

Output  impedance 

500  ohms 

Power 

2-1/2  watts 

Supply  voltage 

115  V,  UOO  cycles 

Accuracy 

2.68  percent  full  scale 

Value  of  fixed 
capacitance 

1000  picofarads 

Data  sampled 

Once  per  second 

This  method  of  gaging  works  well  for  single-phase  fluids  in  any 
gravity  environment  so  long  as  the  fluid  is  uniformly  mixed  with  no  sig- 
nificant density  variations.  But  under  zero-g,  density  and  temperature 
variations  can  exist  in  the  fluid,  especially  when  heat  is  added  with- 
out any  fluid  movement  (convection).  Under  these  conditions,  the  gage 
measures  the  average  density  of  the  oxygen  between  the  two  tubes  which 
may  or  may  not  be  representative  of  the  average  density  in  the  tank. 

If  the  gage  is  either  opened  or  shorted,  the  signal  conditioner 
is  overdriven  and  a greater-than-100-percent  quantity  is  indicated. 

Other  malfunction  characteristics  follow. 
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Failure  Mode 


Effect 


1. 

Elements  of  probe  shorted  to 
each  other 

Full  scale  output 

2. 

Wire  to  either  element 
disconnected  from  probe 

Full  s cale  output 

3. 

Outside  element  of  probe 
or  its  lead  wire  shorted 
to  ground 

Measurement  indicates 
some  value  between  zero 
and  full  scale 

4. 

Inside  element  of  probe 
or  its  lead  shorted  to 
ground 

Random  output  tending 
towards  zero 

5. 

Clear  shorted  probe 

Output  decreases  to  zero, 
remains  0.7  second,  then 
increases  to  correct  value 
in  about  l-l/2  second 

6. 

Clear  open  probe  fault 

Output  assumed  correct 
value  within  l/2  second 

7. 

Intermittent  shorts,  any 
combination 

Output  becomes  irregular 
sawtooth 

OXYGEN  TANK  2 PRESSURE 

INSTRUMENTATION 

The 

shown 

location  of  the  oxygen  tank  pressure  measuring  instrumentation 
schematically  in  figure  B7-4.  Pressure  transducers  for  both 

tanks  are  located  in  a valve  module  assembly  along  with  the  pressure 
switches  and  pressure  relief  valves  as  shown  in  figure  B7-5.  The  valve 
module  assembly  is  connected  to  the  oxygen  tanks  by  19-foot  lengths  of 
l/4-inch  and  3/l6-inch  OD  tubing. 

The  pressure  transducer  consists  of  a diaphragm  0.2  inch  in  diameter 
and  0.015  inch  thick  to  which  are  attached  4 chips  of  strain-sensitive 
semi-conductor  materials  electrically  connected  into  a bridge  circuit. 

When  pressure  is  applied,  deflection  of  the  diaphragm  changes  the  electri- 
cal resistance  of  the  semi-conductor  clips  to  unbalance  the  bridge  and 
develop  an  electrical  output  proportional  to  the  applied  pressure. 

This  output  is  amplified  so  that  full-scale  pressure  of  1050  psia  gives 
a 5 V dc  output  which  is  indicated  on  the  CM  instrument  panel  and  tele- 
metered to  the  ground  through  the  PCM  telemetry  system. 
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Figure  B7-5.-  Pressure  transducer,  relief  valve,  and  pressure  switch. 
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Other  pressure  transducer  parameters  are  as  follows: 


Range 
Accuracy 
Output  voltage 
Output  impedance 
Power 

Voltage  supply 
Data  sampled 


19  to  1080  psia 

±2.68  percent  fuel  range 

0 to  5 V dc 

500  ohms 

1.5  watts 

28  V dc 

Once  per  second 


Under  normal  operating  conditions  oxygen  flow  through  the  19  feet 
of  tubing  is  about  1.5  pounds  per  hour  and  the  pressure  drop  through 
the  line  is  negligible. 


The  physical  dimensions  and  electronic  characteristics  of  the 
pressure  transducer  are  such  that  its  time  lags  are  negligible  as  com- 
pared with  acoustical  lags  of  the  tubing.  If  the  relief  valve  opens 
(normally  set  at  1008  psia)  or  if  the  pressure  in  the  tank  changes 
suddenly,  the  delta  P is  communicated  through  the  tube  at  sonic  velocity 
(8l5  fps  at  288°  R)  so  that  a delay  of  about  23  msec  would  be  expected 
exclusive  of  pressure  drops  due  to  flow  through  the  tubing.  Tests  run 
at  MSC  show  that  when  a step  pressure  increase  is  applied  at  the  tank 
end  of  the  system,  pressure  indicated  by  the  transducer  begins  to  change 
in  about  l6  msec  and  reaches  63  percent  of  the  pressure  change  in  about 
40  msec. 


PULSE  CODE  MODULATION  SYSTEM  DESCRIPTION 


The  instrumentation  system  on  the  Apollo  spacecraft  interfaces 
with  a pulse  code  modulation  (PCM)  telemetry  system.  In  such  a system, 
measurements  are  not  presented  continuously,  but  are  sampled  in  time  and 
quantitized  in  amplitude.  Signal  conditioners  standardize  the  outputs 
from  all  sensors  to  a range  of  0 to  5 volts.  This  voltage  is  fed  into 
the  PCM  system  where  it  is  sampled  and  encoded  for  transmission  to  the 
ground. 

The  PCM  system  basically  consists  of  a number  of  electronic  input 
switches  and  an  analog-to-digital  encoder,  all  of  which  are  controlled 
by  a programmer.  The  analog  switches,  through  programmer  control,  are 
sampled  sequentially  with  a sample  period  of  40  microseconds  for  each 
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input.  The  sampled  voltage  is  then  converted  by  the  encoder  into  an 
8-bit  binary  word  which  is  subsequently  transmitted  to  the  ground.  The 
sampling  rate  for  each  channel  is  selected  on  the  basis  of  the  rapidity 
with  which  that  channel  value  changes  under  normal  operation.  Programmer 
sampling  rates  are  200*  100,  50,  10,  and  1 sample  per  second.  The  end 
result  of  this  operation  when  the  system  is  in  the  high-bit-rate  mode 
is  a serial  stream  of  data  consisting  of  128  eight-bit  words  in  each 
frame  with  50  frames  transmitted  each  second.  This  corresponds  to  a 
bit  rate  of  51,200  bits  per  second.  In  the  low-bit-rate  mode,  1600  bits 
per  second  are  transmitted  and  the  measurements  are  made  at  a reduced 
sampling  rate. 

In  evaluating  telemetry  data,  consideration  must  be  given  to  the 
fact  that  the  system  samples  data  in  time  and  quantitizes  in  amplitude. 

Figure  B7-6  depicts  an  analog  signal  and  its  equivalent  digital 
representation  to  illustrate  several  limitations  of  PCM  telemetry 
systems . 

1.  Fast  transients  which  happen  to  occur  between  the  sample  times 
will  not  be  recorded. 

2.  A long  transient  whose  peak  amplitude  occurs  between  sample 
times  will  be  recorded  with  an  incorrect  peak  amplitude. 

3.  A low-amplitude  transient  may  go  completely  unrecorded  even  if 
its  peak  amplitude  occurs  at  a sample  time. 

4.  A change  of  one  count  in  a parameter  does  not  necessarily  mean 
that  the  analog  quantity  has  changed  by  an  amount  equal  to  the  differ- 
ence in  count  values.  If  the  analog  quantity  happens  to  be  very  close 
to  the  switchover  point  between  counts,  a small  change  can  cause  the 
count  to  change. 

5.  If  the  analog  quantity  remains  for  a long  time  close  to  the 
switchover  point  from  one  count  to  the  next,  the  output  may  toggle 
(jump  back  and  forth)  from  one  count  to  another.  This  does  not  indicate 
that  the  analog  value  is  actually  changing  this  rapidly  but  is  charac- 
teristic of  the  system  when  noise  is  present. 

6.  In  addition  to  the  phenomena  illustrated  in  figure  B7-6,  it 
must  be  recognized  that  noise  in  the  RF  link  may  cause  erroneous  data  to 
be  received  on  the  ground.  Such  errors  usually  appear  in  the  data  as 
values  which  differ  greatly  from  adjacent  outputs  from  the  same  channel. 

Table  B7-II  lists  the  measurements  telemetered  from  the  Apollo  13 
command  and  service  modules  as  well  as  their  ranges,  sampling  rates, 
and  value  of  one  count. 
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Figure  B7-6.-  Digital  coding  and  reconstruction  of  analog  signal. 


TABLE  BY- II.-  COMMAND  AND  SERVICE  MODULE  TELEMETRY  DA'm  SUMMARY 


Meas urement 

Samples /Second 

Units/Count 

Approx . 

Range 

High  Bit 
Rate 

Low  Bit 

un  1 1/ 

Low 

High 

Rate 

CA1820T 

TEMP  CREW  HS  ABL 
SUR  LOC  1A 

°F 

-300 

+850 

1 

- 

4 - *NL 

CA1821T 

TEMP  CREW  HS  ABL 
SUR  LOC  UA 

°F 

-300 

+850 

1 

- 

4 - NL 

CA1822T 

TEMP  CREW  HS  ABL 
SUR  LOC  7 A 

°F 

-300 

+85C 

1 

- 

4 - NL 

CA1823T 

TEMP  CREW  HS  ABL 
SUR  LOC  10A 

0 E 

-300 

+850 

1 

- 

BHI 

SA1830T 

TEMP  SM  SKIN 
SURF  LOC  1A 

°F 

-120 

+2Y0 

1 

- 

1.5  - NL 

SA1831T 

TEMP  SM  SKIN 
SURF  LOC  4A 

°F 

-120 

+270 

1 

- 

1.5  - nl 

SA1832T 

TEMP  SM  SKIN 
SURF  LOC  7A 

Op 

-120 

+270 

1 

- 

1.5  - NL 

SA1833T 

TEMP  SM  SKIN 
SURF  LOC  10A 

Op 

-120 

+270 

1 

- 

1.5  - nl 

SA23TTT 

TEMP  BAY  2 OX 
TANK  SURFACE 

°F 

-100 

+200 

1 

- 

1 .2 

SA23T8T 

TEMP  BAY  3 OX 
TANK  SURFACE 

°F 

-100 

+200 

1 

- 

1.2 

SA23T9T 

TEMP  BAY  5 FUEL 
TANK  SURFACE 

°F 

-100 

+200 

1 

- 

1.2 

SA2380T 

TEMP  BAY  6 FUEL 
TANK  SURFACE 

°F 

-100 

+200 

1 

— 

1.2 

SC0030Q 

QUANTITY  H2  TANK  1 

PCT 

0 

100 

1 

1 

0.4 

SC0031Q 

QUANTITY  H2  TANK  2 

PCT 

0 

100 

1 

1 

0.4 

SC0032Q 

QUANTITY  02  TANK  1 

PCT 

0 

100 

1 

1 

0.4 

SC0033Q 

QUANTITY  02  TANK  2 

PCT 

0 

100 

1 

1 

0.4 

SCD037P 

PRESS  02  TANK  1 

PSIA 

20 

1080 

1 

1 

4.0 

SC0038P 

PRESS  02  TANK  2 

PSIA 

20 

1080 

1 

1 

4.0 

SC0039P 

PRESS  H2  TANK  1 

PSIA 

0 

350 

1 

1 

1.5 

scoo4op 

PRESS  H2  TANK  2 

PSIA 

0 

350 

1 

1 

1.5 

SC0041T 

TEMP  02  TANK  1 

°F 

-325 

+80 

1 

1 

1.6 

SC0042T 

TEMP  02  TANK  2 

°F 

-325 

+80 

1 

1 

1.6 

SCOOU3T 

TEMP  H2  TANK  1 

oF 

-425 

-200 

1 

1 

1.0 

SC0044T 

TEMP  H2  TANK  2 

°F 

-425 

-200 

1 

1 

1.0 

CC01T5T 

TEMP  STATIC 
INVERTER  1 

°F 

+32 

+21+8 

1 

- 

1 

CC01T6T 

TEMP  STATIC 
INVERTER  2 

°F 

+ 32 

+248 

1 

_ 

1 

CC0177T 

TEMP  STATIC 
INVERTER  3 

°F 

+ 32 

+248 

1 

' 

1 - NL 

CC0200V 

AC  VOLTAGE  MAIN 
BUS  1 PHASE  A 

VAC 

0 

+150 

10 

1 

0.6 

CC0203V 

AC  VOLTAGE  MAIN 
BUS  2 PHASE  A 

VAC 

0 

+150 

10 

1 

0.6 

CC0206V 

DC  VOLTAGE  MAIN 
BUS  A 

VDC 

0 

+45 

10 

1 

0.18 

CC 0207V 

DC  VOLTAGE  MAIN 
BUS  B 

VDC 

0 

+45 

10 

1 

0.18 

NL  - Non  Linear 
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TABI£  B7-II-  COMMAND  AND  SERVICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued 


Measurement 

Samples /Second 

Number 

Title 

Unit 

Approx 

. Range 

High  Bit 

Low  Bit 

Units/Count 

Low 

High 

Rate 

Rate 

CC0210V 

DC  VOLTAGE  BAT- 
TERY BUS  A 

VDC 

0 

+U5 

10 

1 

0.18 

CC0211V 

DC  VOLTAGE  BAT- 
TERY BUS  B 

VDC 

0 

+i*5 

10 

1 

0.18 

cc 0215c 

DC  CURRENT  BATT 
CHARGER  OUT 

AMP 

0 

+5 

10 

1 

0.02 

CC0222C 

DC  CURRENT 
BATTERY  A 

AMP 

0 

+100 

10 

1 

O.b 

CC0223C 

DC  CURRENT 
BATTERY  B 

AMP 

0 

+100 

10 

1 

O.b 

CC022liC 

DC  CURRENT 
BATTERY  C 

AMP 

0 

+100 

10 

1 

O.b 

CC0232V 

DC  VOLTAGE  BAT- 
TERY RELAY  BUS 

VDC 

0 

+45 

10 

1 

0.1 8 

SC2060P 

N2  PRESSURE  FC  1 
REGULATED 

PSIA 

0 

75 

10 

- 

0 

u> 

SC2061P 

N2  PRESSURE  FC  2 
REGULATED 

PS  I A 

0 

75 

10 

- 

0.3 

SC2062P 

N2  PRESSURE  FC  3 
REGULATED 

PSIA 

0 

75 

10 

- 

0.3  ! 

SC2066P 

02  PRESSURE  FC  1 
REGULATED 

PSIA 

0 

75 

10 

- 

0.3 

SC2067P 

02  PRESSURE  FC  2 
REGULATED 

PSIA 

0 

75 

10 

- 

0.3 

SC2068P 

02  PRESSURE  FC  3 
REGULATED 

PSIA 

0 

75 

10 

- 

0.3 

SC2069P 

H2  PRESSURE  FC  1 
REGULATED 

PSIA 

0 

75 

10 

- 

0.3 

SC2070P 

H2  PRESSURE  FC  2 
REGULATED 

PSIA 

0 

75 

10 

- 

0.3 

SC2071P 

H2  PRESSURE  FC  3 
REGULATED 

PSIA 

0 

75 

10 

- 

0.3 

SC2081T 

TEMP  FC  1 COND 
EXHAUST 

°F 

+1**5 

+250 

1 

1 

O.b 

SC2082T 

TEMP  FC  2 COND 
EXHAUST 

°F 

+1^5 

+250 

1 

1 

O.b 

SC2083T 

TEMP  FC  3 COND 
EXHAUST 

°F 

+ 1^5 

+250 

1 

1 

O.b 

SC2084T 

TEMP  FC  1 SKIN 

°F 

+ 80 

+550 

1 

1 

2 

SC2085T 

TEMP  FC  2 SKIN 

°F 

+ 80 

+550 

1 

1 

2 

SC2086T 

TEMP  FC  3 SKIN 

°F 

+ 80 

+550 

1 

1 

2 

SC2087T 

TEMP  FC  1 RADIATOR 
OUTLET 

°F 

-50 

+300 

1 

1 

l.b 

SC2088T 

TEMP  FC  2 RADIATOR 
OUTLET 

°F 

-50 

+300 

1 

1 

1.5 

SC2089T 

TEMP  FC  3 RADIATOR 
OUTLET 

°F 

-50 

+300 

1 

1 

1.5 

SC2090T 

RAD  INLET  TEMP  FC  1 

°F 

-50 

+ 300 

1 

- 

1.5 

SC2091T 

RAD  INLET  TEMP  FC  2 

°F 

-50 

+300 

1 

- 

1.5 

SC2092T 

RAD  INLET  TEMP  FC  3 

°F 

-50 

+300 

1 

- 

1.5 

SC2113C 

DC  CURRENT  FC  1 
OUTLET 

AMP 

0 

+ 100 

10 

1 

O.b 
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TABLE  H7-II-  COMMAND  AND  SERVICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued. 


Measurement 

Samples /Second 

Units/Count 

Number 

Title 

Unit 

Approx. 

Range 

High  Bit 

Low  Bit 

Low 

High 

Rate 

Rate 

SC2114C 

DC  CURRENT  FC  2 

AMP 

0 

+100.0 

10 

1 

o.u 

OUTPUT 

SC2115C 

DC  CURRENT  FC  3 

AMP 

0 

+ 100.0 

10 

1 

0.14 

OUTPUT 

SC2139R 

FLOW  RATE  H2  FC  1 

LB/ HR 

0 

.2 

10 

_ 

..001  - NL 

SC21U0R 

FLOW  RATE  H2  FC  2 

LB  /HR 

0 

.2 

10 

- 

.001  - NL 

SC21U1R 

FLOW  RATE  H2  FC  3 

LB/ HR 

0 

.2 

10 

- 

.001  - NL 

SC2142R 

FLOW  RATE  02  FC  1 

LB/ HR 

0 

1 . 7 

10 

- 

.005  - NL 

SC21U3R 

FLOW  RATE  02  FC  2 

LB/HR 

0 

1 . 7 

10 

- 

.005  - NL 

SC21UUR 

FLOW  RATE  02  FC  3 

LB/HR 

0 

10 

- 

.005  - NL 

SC2160X 

PH  FACTOR  WATER 

NORM 

HIGH 

10 

1 

COND  FC  1 

SC2161X 

PH  FACTOR  WATER 

NORM 

HIGH 

10 

1 

COND  FC  2 

SC2162X 

PH  FACTOR  WATER 

NORM 

HIGH 

10 

1 

COND  FC  3 

CC2962C 

CSM  TO  LEM  CURRENT 

AMP 

0 

+ 10 

10 

1 

O.Oh 

MONITOR 

CD0005 v 

DC  VOLTAGE  PYRO 

VDC 

0 

+tO 

10 

- 

0.15 

BUS  A 

CD0006V 

DC  VOLTAGE  PYRO 

VDC 

0 

+ U0 

10 

- 

0.15 

BUS  B 

CD0023X 

CM-SM  RELAY  CLOSE  A 

SEP 

10 

1 

CD002UX 

CM-SM  SEP  RELAY 

SEP 

10 

1 

CLOSE  B 

CD0123X 

SLA  SEPARATION 

SEP 

10 

1 

RELAY  A 

CD0124X 

SLA  SEPARATION 

SEP 

10 

1 

RELAY  B 

CD0130X 

HAND  CONTROLLER 

ABORT 

10 

1 

INPUT  A 

CD0131X 

HAND  CONTROLLER 

ABORT 

10 

1 

INPUT  B 

CD0132X 

EDS  ABORT  LOGIC 

VOTE/ 

ARM 

10 

1 

INPUT  NO  1 

OFF 

CD0133X 

EDS  ABORT  LOGIC 

VOTE/ 

ARM 

10 

1 

INPUT  NO  2 

OFF 

CD013^X 

EDS  ABORT  LOGIC 

VOTE/ 

ARM 

10 

1 

INPUT  NO  3 

OFF 

CD0135X 

EDS  ABORT  LOGIC 

ABORT 

10 

1 

OUTPUT  A 

CD0136X 

EDS  ABORT  LOGIC 

ABORT 

10 

1 

OUTPUT  B 

CD0170X 

RCS  ACTIVATE  SIG  A 

ENABLE 

10 

1 

CD0171X 

RCS  ACTIVATE  SIG  B 

ENABLE 

10 

1 

CD0173X 

CM  RCS  PRESS  SIG  A 

PRESS 

10 

1 

CD017^X 

CM  RCS  PRESS  SIG  B 

PRESS 

10 

I 

CD0200V 

DC  VOLTAGE  LOGIC 

VDC 

0 

+ Uo 

10 

- 

0.15 

BUS  A 

NL  - Non  Linear 
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TABLE  B7-XI.-  COMMAND  AND  SERVICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued. 


Measurement 

Samples /Second 

Units/Count 

Number 

Title 

Unit 

Approx. 

Range 

High  Bit 
Rate 

Low  Bit 
Rate 

Low 

High 

CD0201V 

DC  VOLTAGE  LOGIC 

VDC 

0 

+ 1+0 

10 

_ 

0.15 

BUS  B 

CD0230X 

FWD  HS  JETTISON  A 

JETT 

10 

1 

CD0231X 

FWD  HS  JETTISON  B 

JETT 

10 

1 

cdh5^x 

CSM-LEM  LOCK  RING 

SEP 

10 

1 

SEP  RELAY  A 

CD1155X 

CSM-LEM  LOCK  RING 

SEP 

10 

1 

SEP  RELAY  B 

CE0001X 

DROGUE  DEPLOY  RELAY 

DEPLOY 

10 

1 

CLOSE  A 

CE0002X 

DROGUE  DEPLOY  RELAY 

DEPLOY 

10 

1 

CLOSE  B 

CE0003X 

MAIN  CHUTE  DEPL  DRG 

DEPLOY 

10 

1 

REL  RLY  A 

CE0004X 

MAIN  CHUTE  DEPL  DRG 

DEPLOY 

10 

1 

REL  RLY  B 

CE0321X 

MAIN  CHUTE  DISCON- 

DISC 

10 

1 

NECT  RELAY  A 

CE0322X 

MAIN  CHUTE  DISCON- 

DISC 

10 

1 

NECT  RELAY  B 

CF0001P 

PRESSURE  CABIN 

PSIA 

0 

17 

1 

1 

O.O67 

CF0002T 

TEMP  CABIN 

°F 

+hO 

+]  25 

1 

1 

0.3  - NL 

CF0003P 

PRESS  02  SUIT  TO 

IN 

-5 

+5 

10 

- 

0.01+ 

CABIN  DIFF 

H20 

CF0005P 

PRESS  CO 2 PARTIAL 

MM  HG 

0 

30.00 

I 

1 

0.12  - NL 

CF0006P 

PRESS  SURGE  TANK 

PSIA 

30 

1080 

10 

1 

k 

CF0008T 

TEMP  SUIT  SUPPLY 

°F 

+20 

+95 

1 

1 

0.3 

MANIF 

CF0009Q 

QUANTITY  WASTE 

PCT 

0 

100 

1 

1 

O.U  - NL 

WATER  TANK 

CF0010Q 

QUAN  POTABLE  H20 

PCT 

0 

100 

1 

1 

0.3  - NL 

TANK 

CF0012P 

PRESS  SUIT  DEMAND 

PSIA 

0 

17 

10 

1 

0.07 

REG  SENSE 

CF0015P 

PRESS  SUIT  COM- 

PSID 

0 

1.00 

10 

1 

0.0035  - NL 

PRESSOR  DIFF 

CF0016P 

PRESS  GLYCOL  PUMP 

PSIG 

0 

60 

10 

1 

0 . 2k 

OUTLET 

CF0017T 

TEMP  GLYCOL  EVAP 

°F 

+20 

+95 

1 

- 

0.3 

OUTLET  STEAM 

CF0018T 

TEMP  GLY  EVAP 

°F 

+25 

+75 

1 

1 

0.2 

OUTLET  LIQUID 

CF0019Q 

QUANTITY  GLYCOL 

PCT 

0 

107 

10 

1 

K 

1 

LT\ 

O 

ACCUM 

. 

CF0020T 

TEMP  SPACE  RADI- 

°F 

-50 

+100 

1 

1 

1 

O 

O 

ATOR  OUTLET 

CF003^P 

BACK  PRESS  GLYCOL 

PSIA 

0 

0.25 

1 

- 

0.0008 

EVAPORATOR 

CF0035R 

FLOWRATE  ECS  02 

LB/HR 

0.16 

1 

10 

- 

0.003  - NL 

CF0036P 

PRESS  OUTLET  02 

PSIG 

0 

150 

10 

1 

0.6 

REG  SUPPLY 

NL  - Non  Linear 
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TABLE  B7-II.-  COMMAND  AND  SERVICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued. 


Measurement 

Samples /Second 

Units /Count 

Unit 

Approx 

Range 

High  Bit 

Low  Bit 

Low 

High 

Rate 

Rate 

CFGQ70P 

PRESS  SEC  GLYCOL 
PUMP  OUTLET 

PSIG 

0 

60 

10 

1 

0.24 

CF0071T 

TEMP  SEC  EVAP 
OUTLET  LIQUID 

°K 

+23 

+75 

10 

1 

0.2 

CF0072Q 

QUANTITY  SEC  GLYCOL 
ACCUM 

PCI' 

0 

100 

10 

1 

0.8  - NL 

CF0073P 

PR  SECONDARY  EVAP 
OUT  STEAM 

PSIA 

0.05 

0.25 

1 

- 

0.0008 

CF0120P 

PRESS  H20  AND 
GLYCOL  TANKS 

PSIA 

0 

50 

1 

- 

0.2 

CF0157R 

RATE  GLYCOL  FROM 
THERMAL  LOAD 

LB/ HR 

330 

10 

- 

0.9  - NL 

CFO101T 

TEMP  GLYCOL  EVAP 
INLET 

°F 

+ 35 

+ 100 

1 

- 

0.3 

SF0260T 

TEMP  PRIMARY  RADI- 
ATOR INLET 

°E 

+55 

+ 120 

1 

1 

0.25 

GF0262T 

TEMP  SECONDARY 
RADIATOR  INLET 

°K 

+55 

+120 

1 

1 

0.25 

SF0263T 

SF0266X 

TEMP  SEC  RADIATOR 
OUTLET 

RADIATOR  FLOW  CO NT 
SYS  1 OR  2 

°F 

+ 30 
SYS  1 

+70 
SYS  2 

1 

10 

1 

1 

0.15 

CF0460T 

TEMP  URINE  DUMP 
NOZZLE 

°F 

0 

+100 

1 

1 

0.4 

CF0461T 

TEMP  WASTE  WATER 
DUMP  NOZZLE 

0 K 

0 

+ 100 

1 

I 

0.4 

CG1040V 

120  VDC  PIPA  SUPPLY 
DC  LEVEL 

VDC 

+84 

+135 

1 

- 

0.2 

CG1110V 

2.5  VDC  TM  BIAS 

VDC 

0 

5 

1 

I 

0.02 

CGI 201V 

IMU  28V  .8KC  1 PCT 

VRMS 

0 

30 

1 

- 

0.12  - NL 

CG1331V 

CG1513X 

CG1523X 

CG1533X 

3.2KC  28V  SUPPLY 

28V  IMU  STANDBY 
28V  CMC  OPERATE 
28V  OPTX  OPERATE 

VRMS 

0 

OFF 

OFF 

OFF 

30 

GTBY 

OPR 

OPR 

1 

10 

10 

10 

1 

1 

1 

0.12  - NL 

CG2112V 

IG  IX  RESOLVER  OUT- 
PUT SIN 

VRMS 

-21 

+21 

10 

0.17 

CG 2113V 

IG  IX  RESOLVER  OUT- 
PUT COS 

VRMS 

-22 

+21 

10 

- 

0.17 

CG2117V 

IGA  SERVO  ERROR  IN 
PHASE 

VRMS 

*-3 

+3 

100 

— 

0.025 

CG2142V 

MG  IX  RESOLVER  OUT- 
PUT SIN 

VRMS 

-21 

+21 

10 

- 

0.16 

CG2143V 

MG  IX  RESOLVER  OUT- 
PUT COS 

VRMS 

-20 

+ 40 

10 

' 

0.16 

CG21U7V 

MG A SERVO  ERROR  IN 
PHASE 

VRMS 

— 3 

+ 3 

100 

' 

0.024 

CG2172V 

OG  IX  RESOLVER  OUT- 
PUT SINE 

VRMS 

-21 

+21 

10 

0.16 

NL  - Non  Linear 
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TABLE  B7-II.-  COMMAND  A W SERVICE  MODULE  TELEMETRY  DATA  SUMNER Y - Continued. 


Measurement 

Samples /Second 

Units/Count 

Number 

Title 

Unit 

Approx. 

Range 

High  Bit 
Rate 

Low  Bit 
Rate 

Low 

High 

CG21T3V 

OG  IX  RESOLVER  OUT1- 

VRMS 

+21 

10 

0.16 

PUT1  COS 

CG2177V 

OGA  SERVO  ERROR 

VRMS 

-0 

+3 

100 

_ 

0.025 

IN  PHASE 

CG2300T 

PI PA  TEMPERATURE 

°F 

+119 

+1U0 

1 

1 

0.08 

CG3721V 

SHAFT  CDU  DAC  OUT- 

VRMS 

-12 

+1 2 

10 

0.09 

PUT 

CG3722V 

TRUNNION  CDU  DAC 

VRMS 

-12 

+12 

10 

_ 

0.09 

OUTPUT 

CG5040X 

CMC  WARNING 

WARN 

10 

1 

CH3500H 

FDAI  CM/SM  ATT 

DEG 

-5 

+9 

50 

_ 

MM 

ERROR  PITCH 

-1C;' 

■a  5 

CH3501H 

FDAI  CM/SM  ATT 

DEG 

r; 

“ s 

+5 

50 

_ 

MM 

ERROR  YAW 

-15 

+15 

CH3502H 

FDAI  CM/SM  ATT 

DEG 

-5 

+5 

100 

- 

MM 

ERROR  ROLL 

-50 

< 50 

CH3503R 

FDAI  SCS  BODY  RATE 

DEG/ 

-J. 

+1 

100 

_ 

MM 

PITCH 

SEC 

-9 

+5 

-10 

+10 

CH350UR 

FDAI  SCS  BODY  RATE 

DEG/ 

-1 

+1 

100 

- 

MM 

YAW 

SEC 

-5 

+5 

-10 

+10 

CH3505R 

FDAI  SCS  BODY  RATE 

DEG/ 

+1 

100 

- 

MM 

ROLL 

SEC 

-5 

-50 

+20 

CH3517H 

GIMBAL  POSITION 

DEG 

-5 

+5 

100 

- 

0 . OU 

PITCH  1 OR  2 

CH3518H 

GIMBAL  POSITION 

DEG 

-5 

+5 

100 

- 

0.0U 

YAW  1 OR  2 

CH35U6X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

- 

C3/13/X 

i 

OFF 

CH35*+7X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

kk/lk/X 

OFF 

CH35^8X 

RCS  SOLENOID  ACT 

FIR E/ 

ARM 

200 

- 

A3/23/-X 

OFF 

CH35^9X 

RCS  SOLENOID  ACT 

FIRE  / 

ARM 

200 

- 

Ch/2k/-X 

OFF 

CH3550X 

RCS  SOLENOID  ACT 

FIRE  / 

ARM 

200 

- 

D3/25/X 

OFF 

CH3551X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

- 

BU/26/X 

OFF 

CH3552X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

- 

B3/15/-X 

OFF 

CH3553X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

- 

D4/16/-X 

OFF 

CH355i+X 

RCS  SOLENOID  ACT 

FIRE 

ARM 

200 

- 

Bl/ll/Z 

OFF 

CH3555X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

- 

D2/22/Z 

OFF 

MM  - Multiple  Mode  Calibration 
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TABLE  337- I i 


COMMAND  AND  SERVICE  MODULE  TELEMETRY  DA.  TA  NUMMARY  - Continued. 


Measurement 

Samples /Second 

Units /Count 

B 

Title 

Approx.  Range 

High  Bit 
Rate 

Low  Bit 
Rate 

Low 

High 

CH3556X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

D1/21/-Z 

OFF 

CH3557X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

_ 

B2/12/-Z 

OFF 

CH3558X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

_ 

Al/Y 

OFF 

CH3559X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

_ 

C2/Y 

OFF 

CH3560X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

_ 

Cl/ -Y 

OFF 

CH3561X 

RCS  SOLENOID  ACT 

FIRE/ 

ARM 

200 

A2/-Y 

OFF 

CK3571+X 

TRANSLATIONAL 

OFF 

ON 

10 

I 

CONTROLLER  XC  MD 

CH3575X 

TRANSLATIONAL 

OFF 

ON 

10 

1 

OONTROLLER-XC  MI) 

CH3576X 

TRANSLATIONAL 

OFF 

ON 

10 

1 

CONTROLLER  YC  MD 

CH3577X 

TRANSLATIONAL 

OFF 

ON 

10 

1 

CONTROLLER  -YC  MD 

CH3578X 

TRANSLATIONAL 

OFF 

ON 

10 

1 

CONTROLLER  ZC  MD 

CH3579X 

TRANSLATIONAL 

OFF 

ON 

10 

1 

CONTROLLER  -SC  MI) 

CH3582V 

SCS  TVC  AUTO  COM- 

VI.)  C 

-10 

+10 

100 

- 

0.08 

HAND  PITCH 

CH3583V 

SCS  TVC  AUTO  COM- 

VPO 

-10 

+ 10 

100 

- 

0.08 

MAND  PITCH 

CH3585H 

ROT  CONTROL /MT  VC 

VDC 

-10 

+ 10 

50 

- 

0.078 

PITCH 

CH3586H 

ROT  CONTROL /MTV C 

VDC 

-10 

+ 10 

50 

- 

0.08 

YAW  CMC 

CH3587H 

ROT  CONTROL/MTVC 

DEG 

-11 

+ 11 

50 

- 

0.087 

ROLL  CMC 

CH3588X 

ATTITUDE  DEADBAND 

MAX 

MIN 

10 

1 

MINIMUM 

CH3590X 

HIGH  PRO  RATE  LIMIT 

LOW 

HIGH 

10 

1 

CH3592X 

FDAI  SCALE  ERROR  5, 

OFF 

ON 

10 

1 

RATE  5 

CH3593X 

FDAI  SCALE  ERROR 

OFF 

ON 

10 

1 

50/15,  RT50/10 

CH3600X 

SCS  DELTA  V 

CSM 

LM/ 

10 

1 

CG-LM/CSM  POS 

CSM 

CH3601X 

DIR  RCS  SW  NO  1 

OFF 

ENABLE 

10 

1 

ENABLE  POS 

CH3602X 

DIR  RCS  SW  NO  2 

OFF 

ENABLE 

10 

1 

ENABLE  POS 

CH 3bOUX 

SPS  SOLENOID 

FIRE/ 

ARM 

10 

1 

DRIVER  NO  1 

OFF 

CH3605X 

SPS  SOLENOID 

FIRE/ 

ARM 

10 

1 

DRIVER  NO  2 

OFF 
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TABLE  B7-II.-  COMMAND  AMD  SERVICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued. 


Measurement 

Samples /Second 

Units/Count 

Number 

Title 

Unit 

Approx 

. Range 

High  Bit 
Rate 

Low  Bit 
Rate 

Low 

KHB 

- CH3606X 

LIMIT  CYCLE  SW 

ON 

OFF 

10 

1 

OFF  POS 

CH360TX 

SC  CONTROL  SOURCE 

CMC 

SCS 

10 

1 

SWITCH 

CH3609X 

ROLL  MAN  ATT  SW 

OFF 

ON 

10 

1 

ACCEL  CMD  POS 

CH 361 OX 

R MAN  ATT  SW  MIN 

OFF 

ON 

10 

1 

IMP  CMD  POS 

CH3612X 

PITCH  MAN  ATT  SW 

OFF 

ON 

10 

1 

ACCEL  CMD  POS 

CH3613X 

P MAN  ATT  SW  MIN 

OFF 

ON 

10 

1 

IMP  CMD  POS 

CH3615X 

YAW  MAN  ATT  SW 

OF!1 

ON 

10 

1 

ACCEL  CMD  POS 

CH3616X 

YAW  MAN  ATT  SW 

OFF 

ON 

10 

1 

MIN  IMP  CMD  POS 

CH3623X 

GYRO  1 COMB  SPIN 

LOW 

NORM 

10 

1 

MTRS  RUN  DET 

CH3621+X 

GYRO  2 COMB  SPIN 

LOW 

NORM 

10 

1 

MTRS  RUN  DET 

CH3635X 

BMAG  MODE  SW-ROLL 

OFF 

ON 

10 

_ 

ATT  1 RT  2 

CH3636X 

BMAG  MODE  SW-ROLL 

OFF 

ON 

10 

_ 

RATE  2 

CH3638X 

BMAG  MODE  SW-PITCH 

OFF 

ON 

10 

_ 

ATT  1 RT  2 

CH3639X 

BMAG  MODE  SW-PITCH 

OFF 

ON 

10 

_ 

RATE  2 

CH36U1X 

BMAG  MODE  SW-YAW 

OFF 

ON 

10 

_ 

ATT  1 RT  2 

CH36U2X 

BMAG  MODE  SW-YAW 

OFF 

ON 

10 

_ 

RATE  2 

CH 3666c 

TVC  PITCH  DIFF 

MAMP 

-800 

+800 

200 

_ 

CURRENT 

CH3667C 

TVC  YAW  DIFF 

MAMP 

-800 

+800 

100 

- 

CURRENT 

CJ0060J 

EKG  COMMANDER  LH 

MV 

NA 

NA 

200 

_ 

COUCH 

CJ0061J 

EKG  COMMANDER  CTR 

MV 

NA 

NA 

200 

_ 

COUCH 

CJ0062 J 

EKG  LM  PILOT 

MV 

NA 

NA 

200 

_ 

RH  COUCH 

CJ0200R 

RESP  RATE  CMD , 

OHM 

NA 

NA 

50 

- 

CM/LM  PILOT 

CJ0201R 

RESP  RATE  CM 

OHM 

NA 

NA 

50 

- 

PILOT  C7TR  COUCH 

CJ0202R 

RESP  RATE  LM  PILOT 

OHM 

NA 

NA 

50 

- 

RH  COUCH 

CK0026A 

CM  ACCEL  X-AXIS 

G 

-2 

+10 

100 

0.05 

CK0027A 

CM  ACCEL  Y-AXIS 

G 

-2 

+2 

100 

- 

0.016 
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TABLE  B7-II.-  COMMAND  AND  SERVICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued. 


Measurement 

Sample  s /See  ond 

Units/Count 

Number 

Title 

Unit 

Approx 

Range 

High  Bit 
Rate 

I iOw  Bit 
Rat  e 

Low 

High 

CK0028A 

CM  ACCEL  Z-AXIS 

G 

-2 

+•2 

100 

0.016 

CKIO^IK 

RADIATION  DOS- 

VDC 

0 

5 

10 

0.02  - NL 

IMETER  1 

CK1052K 

RADIATION  DOS- 

VUC 

0 

5 

10 

_ 

0.02  - NL 

IMETER  2 

CK1053R 

DOSIMETER  RATE 

VDC 

0 

5 

1 

_ 

0.02  - NL 

CHANGE 

CK10U3 

70mm  HASSELBLAD 

OFF 

ON 

100 

CK1044 

70mm  LUNAR  PHOTOG- 

OFF 

ON 

100 

RAPHY 

- 

SP0001P 

HE  PRESS  TANK 

PS  I A 

0. 

5000 

10 

1 

21 

SP0002T 

HE  TEMP  TANK 

°K 

-100 

+200 

1 

_ 

1.2 

3P0003P 

PRESS  OXIDIZER 

PS  LA 

0 

2^0 

10 

1 

1 

TANKS 

SP0006P 

PRESS  FUEL  TANKS 

PSIA 

0 

250 

10 

1 

1 

SP0022H 

POSITION  FUEL /OX 

DEG 

0 

90 

10 

- 

o,»*6 

VLV  1 POT  B 

SP0023H 

POSITION  FUEL /OX 

DEG 

0 

90 

10 

- 

0.46 

VLV  2 POT  B 

SP002UH 

POSITION  FUEL/OX 

DEG 

0 

90 

10 

- 

0.46 

VLV  3 POT  B 

SP0025H 

POSITION  FUEL/OX 

DEG 

0 

90 

10 

- 

0.46 

VLV  1*  POT  B 

SP0045T 

TEMP  ENG  VALVE  BODY 

°F 

0 

+200 

1 

- 

0.8 

spoo48t 

TEMP  ENG  FUEL  FEED 

°F 

0 

+200 

1 

1 

0.8 

LINE 

SP0049T 

TEMP  ENG  OX  FEED 

°F 

Q 

+200 

1 

1 

0.8 

LINE 

SP0054T 

TEMP  1 OX  DISTRI- 

°F 

0 

+200 

1 

- 

0.8 

BUTION  LINE 

SP0057T 

TEMP  1 FUEL  DISTRI- 

°F 

0 

+200 

1 

- 

0.8 

BUTION  LINE 

SP0061T 

ENG  INJECTOR  FLANGE 

°F 

0 

600 

1 

- 

2.3 

TEMP  NO  1 

SP0062T 

ENG  INJECTOR  FLANGE 

°F 

0 

600 

1 

- 

2.3 

TEMP  NO  2 

SP0600P 

ENG  VLV  ACT  SYS 

PSIA 

0 

5000. 

1 

- 

21 

TANK  PR  PR I 

SP0601P 

ENG  VLV  ACT  SYS 

PSIA 

0 

5000. 

1 

- 

21 

TANK  PR  SEC 

SP0655Q 

QUAN  OX  TANK  1 

PCT 

0 

90 

1 

- 

0.2 

PRI -TOTAL  AUX 

SPO656Q 

QUAN  OX  TANK  2 

PCT 

0 

60 

1 

- 

0.2 

SP0657Q 

QUAN  FUEL  TANK  1 

PCT 

0 

90 

1 

- 

0.2 

PRI -TOTAL  AUX 

SPO658Q 

QUAN  FUEL  TANK  2 

PCT 

0 

60 

1 

- 

0.2 

SP0661P 

PRESS  ENGINE 

PSIA  ! 

0 

150 

100 

- 

0.6 

CHAMBER 

SP0930P 

PRESS  FUEL  SM/ENG 

PSIA 

0 

300 

10 

- 

1.3 

INTERFACE 

SP0931P 

PRESS  OX  SM/ENG 

PSIA 

0 

300 

10 

- 

1.3 

INTERFACE 

I 
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TABLE  B7-II.-  COMMAND  AND  SERVICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued. 


Measurement 

— 

Samples /Second 

Units/Count 

Number 

Title 

Unit 

Approx. 

Range 

High  Bit 
Rate 

Low  Bi  t 

Low 

Rate 

CR0001P 

HE  PRESS  TANK  A 

PSIA 

0. 

5000 

1 

1 

21 

CR0002P 

HE  PRESS  TANK  B 

PSIA 

0. 

5000 

1 

1 

21 

CR0003T 

HE  TEMP  TANK  A 

°F 

0 

+300 

10 

1 

1 . 2 

croooUt 

HE  TEMP  TANK  B 

°F 

0 

+300 

10 

1 

1.2 

CR0035P 

PRESS  CM-RCS  HE 
MANIFOLD  1 

PSIA 

0 

400 

10 

1 

1.7 

CR0036P 

PRESS  CM-RCS  HE 
MANIFOLD  2 

PSIA 

0 

400 

10 

1 

1-7 

SR5001P 

HE  PRESS  TANK  A 

PSIA 

0 

5000 

1 

— 

1 

21 

SR5002P 

HE  PRESS  TANK  B 

PSIA 

0 

5000 

1 

1 

21 

SR5003P 

HE  PRESS  TANK  C 

PSIA 

0 

5000 

1 

1 

21 

SR500UP 

HE  PRESS  TANK  D 

PSIA 

0 

5000 

1 

1 

21 

SR5013T 

HE  TEMP  TANK  A 

°F 

0 

+100 

10 

1 

0.4 

SR501UT 

HE  TEMP  TANK  B 

°F 

0 

+100 

10 

1 

0.4 

SR5015T 

HE  TEMP  TANK  C 

°F 

0 

+100 

10 

1 

0.4 

SR5016T 

HE  TEMP  TANK  D 

°F 

0 

+100 

10 

1 

0.4 

SR5025Q 

QUAN  SM  RCS  PRO 
SYS  A 

VDC 

0 

5 

1 

1 

0.02 

SR5026Q 

QUAN  SM  RCS  PRO 
SYS  B 

VDC 

0 

5 

1 

1 

0.02 

SR502TQ 

QUAN  SM  RCS  PRO 
SYS  C 

VDC 

0 

5 

1 

1 

0 

0 

ro 

SR5028Q 

QUAN  SM  RCS  PRO 
SYS  D 

VDC 

0 

5 

1 

1 

0.02 

SR5065T 

TEMP  ENGINE  PACK- 
AGE A 

°F 

0 

+300 

1 

- 

1.2 

SR5066T 

TEMP  ENGINE  PACK- 
AGE B 

°F 

0 

+ 300 

1 

- 

1.2 

SR5067T 

TEMP  ENGINE  PACK- 
AGE C 

°F 

0 

+ 300 

1 

- 

1.2 

SR3068T 

TEMP  ENGINE  PACK- 
AGE D 

°F 

0 

+300 

1 

- 

1.2 

SR5729P 

A HE  MANIFOLD  PRESS 

PSIA 

0 

400 

10 

1 

1.7 

SR5733P 

OX  MANIFOLD  PR 
SYS  A 

PSIA 

0 

300 

10 

- 

1.3 

SR5737P 

FUEL  MANIFOLD  PR 
SYS  A 

PSIA 

0 

400 

10 

1 

1-7 

SR5776P 

B HE  MANIFOLD  PRESS 

PSIA 

0 

400 

10 

1 

1.7 

SR5780P 

OX  MANIFOLD  PR 
SYS  B 

PSIA 

0 

300 

10 

- 

1-3 

SR5784P 

FUEL  MANIFOLD  PR 
SYS  B 

PSIA 

0 

400 

10 

1 

1.7 

SR5817P 

C HE  MANIFOLD  PRESS 

PSIA 

C 

400 

10 

1 

1.7 

SR5820P 

OX  MANIFOLD  PR 
SYS  C 

PSIA 

0 

300 

10 

~ 

1.3 

SR5821P 

OX  MANIFOLD  PR 
SYS  D 

PSIA 

0 

300 

10 

1.3 
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TABLE  B7-II--  COMMAND  AND  CKh'VICE  MODULE  TELEMETRY  DATA  SUMMARY  - Continued 


Measurement 

Samples /Second 

Units /Count 

Number 

Title 

Unit 

Approx. 

Range 

High  Bit 
Rate 

Low  Bit 
Rate 

Low 

High 

SR5822P 

FUEL  MANIFOLD  PR 

PS  1 A 

0 

hOO 

10 

1 

l.T 

SYS  C 

SR5823P 

FUEL  MANIFOLD  PR 

PS  I A 

0 

koo 

10 

1 

1.7 

SYS  D 

SR5830P 

D HE  MANIFOLD  PRESS 

PS  I A 

0 

400 

10 

1 

1.7 

BS0080X 

EDS  ABORT  REQUEST  A 

NORM 

ABORT 

10 

1 

BS0081X 

EDS  ABORT  REQUEST  B 

NORM 

ABORT 

10 

1 

CS0150X 

MASTER  CAUTION- 

WARN/ 

NORM 

10 

1 

WARNING  ON 

OFF 

LS0200H 

ANGLE  OF  ATTACK 

PS  ID 

U 

5 

10 

- 

o.oiT 

CS0220T 

TEMP  DOCKING  PROBE 

°F 

-100 

+300 

1 

- 

1.7 

CT0012X 

DSE  TAPE  MOTION 

OFF 

MOTION 

10 

1 

MONITOR 

CT  0015V 

SIG  COND  POS  SUPPLY 

VDC 

22 

10 

1 

0.09 

VOLTS 

crooi6v 

SIG  COND  NEG  SUPPLY 

VDC 

-22 

0 

10 

1 

0.09 

VOLTS 

crooiTV 

SENSOR  EXCITATION 

VDC 

0 

5 . 5 

10 

i 

0.02 

5 VOLTS 

CT0018V 

SENSOR  EXCITATION 

VDC 

0 

11. 

10 

1 

O.Oh 

10  VOLTS 

CT0120X 

PCM  BIT  RATE  CHANGE 

LOW 

HIGH 

1 

1. 

8 BIT 

CT 0125V 

PCM  HI  LEVEL  85 

VDC 

0 

+5 

10 

1 

0.02 

PERCENT  REF 

CT0126V 

PCM  HI  LEVEL  15 

VDC 

+5 

10 

1 

0.02 

PERCENT  REF 

CT0262V 

UDL  VALIDITY  SIG 

NA 

NA 

50 

10 

U-BIT 

CT03i40X 

PCM  SYNC  SOURCE  EXT 

I NT 

EXT 

10 

- 

OR  I NT 

CT0620E 

S-BAND  REC  1-2  AGC 

COUNTS 

1 

25^ 

10 

1 

1 - NL 

VOLTAGE 

cro6i40F 

S-BAND  RCVR  1-2 

COUNTS 

1 

25^ 

10 

- 

1 - NL 

STATIC  PH  ERR 

ST0820K 

PROTON  COUNT  RATE 

KHz 

0 

1O0 

10 

- 

0.015  - nl 

CHANNEL  1 

ST0821K 

PROTON  COUNT  RATE 

KHz 

0 

10 

10 

- 

0.0015  - NL 

CHANNEL  2 

ST0822K 

PROTON  COUNT  RATE 

KHz 

0 

JO 

10 

- 

0.0015  - nl 

CHANNEL  3 

ST0823K 

PROTON  COUNT  RATE 

KHz 

0 

10 

10 

- 

0.0015  - NL 

CHANNEL  h 

ST0830K 

ALPHA  COUNT  RATE 

KHz 

0 

10 

10 

- 

0.0016  - NL 

CHANNEL  1 

ST0831K 

ALPHA  COUNT  RATE 

KHz 

0 

10 

10 

- 

0.0015  - NL 

CHANNEL  2 
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TABLE  B7-II--  UOMMMtf D AND  UERVTCE  MODULE  TELEMETRY  DATA  CLMTARY 


Concluded  . 


Measurement 

Samples/Second 

Units /Count 

Number 

Title 

Unit 

Approx 

Range 

High  Bit 

Low  Bit 

Low 

Rate 

Rate 

ST0832K 

ALPHA  COUNT  HATE 

KHz 

0 

10 

- 

0.0015  - NL 

CHANNEL  3 

0.015  - nl 

STO838K 

PHOTON-ALPHA  INTEGR 

KHz 

0 

100 

10 

- 

COUNT  HATE 

1.2  - NL 

ST0840T 

TEMP  NUCLEAR  PAR- 

°F 

-120 

+200 

1 

- 

TICLE  DET 

1.2  - NL 

l>to84it 

TEMP  NUCLEAR  PAR- 

°F 

-120 

+200 

1 

- 

TICLE  ANALYZER 

NL  - Non  Linear 
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MISSION  CONTROL 


The  Flight  Director  in  Mission  Control  is  supported  by  a team  of 
specialists  who  are  responsible  for  different  aspects  of  spacecraft 
operation.  These  specialists  are  located  in  Mission  Control  and  sit  in 
front  of  console  displays  which  provide  real-time  telemetry  data.  Each 
specialist  is  in  voice  contact  with  a group  of  support  personnel  in 
adjacent  rooms  who  also  have  access  to  real-time  telemetry  data.  See 
Appendix  A,  Part  A4  for  a description  of  the  organization  of  Mission 
Control. 

The  display  console  for  the  CSM  Electrical  and  Environmental 
Engineer  (EECOM)  is  shown  in  figure  B7-7  and  is  representative  of  the 
type  of  displays  available  to  all  the  specialists  in  the  Mission  Con- 
trol Center.  The  two  television  monitors  on  the  console  are  used  to 
display  real-time  telemetry  data.  Although  various  data  formats  are 
available  to  the  EECOM,  the  two  displays  most  frequently  in  use  are 
shown  in  figures  B7-8  and  B7-9*  These  displays  are  updated  once  per 
second. 

As  an  aid  in  recognizing  out-of-tolerance  parameters  and  space- 
craft events,  three  groups  of  event  indicators  are  provided  at  the  top 
of  the  console.  The  lights  on  these  panels  which  alert  the  EECOM  to 
out-of-tolerance  parameters  are  referred  to  as  limit  sense  lights.  A 
limit  sense  light  comes  on  whenever  the  parameter  in  question  falls 
outside  of  high  and  low  limits  which  are  manually  set  by  the  EECOM  for 
that  particular  parameter.  Among  the  72  lights  on  panel  3,  there  are 
a total  of  12  limit  sense  lights  for  pressure,  temperature,  and  quantity 
in  each  cryogenic  oxygen  and  hydrogen  tank.  In  normal  operation,  the 
EECOM  sets  fairly  tight  limits  on  the  limit  sense  lights  in  order  to 
get  an  immediate  indication  of  parameter  variations.  Consequently,  it 
is  not  unusual  for  several  limit  sense  lights  to  be  burning. 

Besides  the  limit  sense  lights,  there  are  lights  which  indicate 
spacecraft  events.  One  of  these,  located  in  the  upper  row  of  panel  9, 
indicates  the  presence  of  a master  caution  and  warning  in  the  spacecraft. 

The  following  is  a list  of  the  system  specialists  in  Mission  Control 

(a)  Retrofire  Officer  (RETRO)  - responsible  for  abort  planning, 
deorbit/entry  times,  and  landing  point  prediction. 

(b)  Flight  Dynamics  Officer  (FIDO)  - responsible  for  coordinating 
and  participating  in  mission  planning  and  the  control  of  the  trajectory 
aspects  of  the  mission,  including  powered  flight  trajectory,  abort,  and 
orbital  GO/NO  GO  decision. 
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;ure  B7-7--  C3M  EECOM  engineer  console. 
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Figure  B7-8.-  Electrical  power  system  parameters  display. 


LM 18  3 9 CSM  ECS-CRVO  TAB  06  13 


UJ 


^ o oo 

rt  uS  ro 
co  r — 


C f) 

H 0 l L 

H U ~ ' 

z a ^ 

- < CL 

-I  > 

OH  H 

0 O 

U CL  Z 

> D Cl 

cr  u ^ a 

- < U D < 

5 < cl  a 


q:  a)  (D  o 

CL  H H 10 

i o o rvj 
o o o 


co 

Lf\ 

SO 

^jf 

lTn 

LT\ 

O 


LL  LL  LL 

u u to 


sO 


r-— 

os 

CSJ 

LA 

CO 

l r\ 

S 

LL 

LL 

LL 

< 

LL 

(/) 

CL 

H 

H 

H 

H 

H 

Z 

H 

CL 

D 

D 

— 

0 

0 

d 

< 

< 

CL 

O 

< 

UJ 

UJ 

< 

< 

> 

H 

H 

> 

cr 

LU 

if) 

0) 

UJ 

o 

H 

r- 

00 

CM 

00 

i-t 

co 

rH 

O 

H 

o 

o 

o 

o 

o 

o 

o 

o 

LL 

LL 

U. 

LL 

LL 

u 

o 

O 

O 

o 

O 

sO 

1 

LU 

Z 

OO 

CO 

LT\ 

sO 

CSJ 

— 

OO 

CVJ 

o 

sO* 

0’ 

sO* 

SO* 

uS 

1 

CO 

0- 

sO 

CSJ 

CSJ 

(VJ 

— 

— 

— 

I 

cr 

1 

H 

O 

LL 

LL 

< 

IL 

< 

if) 

i 

H 

U 

— 

o 

o 

— 

o 

— 

(L 

0J 

Z 

CL 

CO 

if) 

0) 

\ 

GO 

< 

CL 

CL 

H 

0. 

< 

rH 

rH 

_J 

-1 

> 

H 

1 

o 

H 

H 

H 

CM 

> 

0 

0 

o 

H 

CL 

D 

(/) 

X 

-1 

-i 

u 

CL 

Z 

D 

0 

LU 

> 

LL 

— 

0 

cr 

cr 

> 

D 

CL 

< 

CL 

i 

D 

Q 

> 

cr 

O 

o 

O 

UJ 

< 

o 

U 

< 

< 

o 

=> 

< 

< 

H 

> 

CVJ 

cr 

0 

Q 

< 

CL 

cr 

cr 

iJ) 

LU 

I 

u 

CM 

Z 

LL 

1 

(0 

N 

0 

CVJ 

O 

CVJ 

00 

CO 

rH 

o 

CVJ 

10 

ID 

o 

rs 

N 

L0 

<0 

rs 

N 

CVJ 

_J 

O 

CM 

H 

LU 

O 

O 

CM 

CVJ 

o 

o 

rH 

< 

O 

o 

if) 

O 

O 

O 

O 

o 

o 

o 

H 

LL 

LL 

1 

LL 

LL 

LL 

LL 

LL 

LL 

LL 

0 

(/) 

U 

o 

o 

if) 

if) 

o 

o 

O 

H 

i 

OJ 

0 


CO 

o 


CO 

OO 


LO 

CO 

CNJ 


'CJ-  so  O 

r-  rH  CM 

^3- 


co 

o 


Si 


so 


la  co  r — cz> 
Csl  I — i — l CVJ 
cvj 


h M O 
O O so 

i CSJ 


CO 

SO  r— I 

co  r — * 0s  r— i 
- — i r^-  oo  la 

O CSJ 


H 

UJ 

0 


l r\ 
sO 

lA 

LO 

o 

LU 

H 

U 


H 

cr 

o 

CL 

CL 

D 


UJ 

LL 


r— 1 

CO 

OO 

SO 

o 

CO 

r— 

sO 

OO 

rH 

lo 

r‘ 

CD 

891 

co 

CSJ 

c— 

i— H 

LO 

o 

r— H 

o 

< 

< 

< 

0 

Q 

< 

CQ 

Q 

Q 

< 

cr 

— 

— 

— 

CM 

— 

— 

-l 

__ 

— 

— 

X 

if) 

if) 

if) 

I 

(/) 

if) 

if) 

cn 

CO 

CL 

CL 

d 

d 

d 

d 

d 

d 

CD 

z 

_l 

CL 

— 

d 

d 

d 

d 

> 

< 

< 

Z 

H 

d 

— 

d 

d 

d 

d 

O’  CL 

d 

$ 

00 

d 

< 

<1 

< 

< 

z 

O 

< 

Z 

UJ 

UJ 

U 

u 

< 

—) 

o 

— 

H 

H 

d 

0 

0 

5 

L L 

GO 

— 

— 

5 

cr 

cr 

H 

CVJ 

< 

D 

D 

0 

D 

D 

CM 

CM 

-1 

U 

0) 

(/) 

o 

if) 

if) 

¥ 

0 

O 

H 

H 

H 

rH 

cvj 

co 

in 

10 

10 

in 

n 

o 

rH 

o 

rH 

o 

CM 

CVJ 

CO 

co 

in 

o 

o 

o 

o 

o 

O 

0 

o 

o 

co 

o 

o 

o 

o 

o 

o 

o 

LL 

LL 

U_ 

LL 

LL 

LL 

LL 

IL 

0 

o 

u 

o 

U 

u 

o 

o 

LO 

LO 

^3" 

r— 

LO  SO 

< 

H 

LL 

c/> 

s 

LO 

sO 

«— 1 

S’ 

CO* 

s 

co 

O CSJ 

r—  r— 

o 

o 

CQ 

r~— 1 

co 

d 

-1 

d 

LL 

LL 

0 

H 

CD 

H 

CD 

LL 

LL 

O 

0 

I 

O 

_) 

O 

-J 

o 

o 

5 

d 

d 

5 

> 

H 

H 

> 

d 

O' 

H 

> 

N 

H 

-1 

H 

O 

d 

o 

rH 

o 

H 

UJ 

UJ 

z 

N 

d 

* 

co 

* 

H 

d 

0 

■J 

-I 

0 

D 

1 

1 

1 

Z 

d 

CM 

UJ 

UJ 

CD 

CD 

UJ 

z 

(0 

0) 

o 

CO 

H 

— 

I 

H 

H 

< 

< 

z 

CO 

CO 

— 

CD 

(VJ 

if) 

CO 

H 

H 

— 

0 

o 

1 

1 

i 

D 

< 

0 

< 

< 

0 

O 

cr 

CM 

> 

00 

co 

CVJ 

CO 

U 

u 

> > CL 

d 

D 

X 

cr 

co 

CO 

u 

1 

1 

1 

00 

CM 

in 

0) 

o 

O 

rH 

ps 

CM 

rH 

o 

O 

o 

o 

rH 

co 

CO 

co 

co 

* 

o 

o 

o 

o 

o 

* 

o 

o 

o 

o 

o 

o 

o 

o 

o 

o 

o 

o 

o 

LL 

LL 

LL 

LL 

LL 

LL 

LL 

o 

o 

o 

o 

o 

o 

o 

o 

o 

u 

if) 

CO 

(/> 

B-155 


Figure  B7-9*-  Cryogenic  system  display. 


(c)  Guidance  Officer  (GUIDO)  - responsible  for  the  utilization  of 
the  guidance  and  navigation  system,  correlation  of  inertial  alignment, 
and  evaluation  of  terminal  phase  actions  in  support  of  rendezvous. 

(d)  CSM  Electrical,  Environmental,  and  Communications  Engineer 
(EECOM)  - responsible  for  monitoring  and  evaluating  the  performance  of 
the  electrical  power,  environmental  control,  instrumentation,  and  sequen 
tial  systems  of  the  command  and  service  modules. 

(e)  CSM  Guidance  and  Navigation  Officer  (GNC)  - responsible  for 
monitoring  and  evaluating  the  performance  of  the  guidance  and  navigation 
propulsion,  and  stabilization  and  control  systems  of  the  command  and 
service  modules. 

(f)  LM  Electrical,  Environmental,  and  EMV  Officer  (TELMU)  - respon- 
sible for  monitoring  and  evaluating  the  performance  of  the  primary 
guidance  and  navigation,  abort  guidance,  control  electronics,  ascent 
propulsion,  descent  propulsion,  and  reaction  control  systems  of  the 
lunar  module . 

(g)  LM  Control  Officer  (CONTROL)  - responsible  for  monitoring  and 
evaluating  the  performance  of  the  electrical,  communications,  instru- 
mentation, sequential,  and  environmental  control  systems  of  the  lunar 
module . 

(h)  Instrumentation  and  Communication  Officer  (INCO)  - responsible 
for  monitoring  and  evaluating  the  performance  of  spacecraft  communica- 
tions systems. 

(i)  Procedures  Officer  (PROCEDURES)  - responsible  for  the  detailed 
procedures  implementation  of  Mission  Control. 

(j)  Flight  Activities  Officer  (FAO)  - responsible  for  the  detailed 
implementation  of  the  flight  plan  and  its  revision. 

(k)  Aeromedical  Officer  (SURGEON)  - directs  sill  operational  medical 
activities  concerned  with  the  mission. 
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The  following  table  lists  the  members  of  the  White  and  Black 
Mission  Control  teams.  The  White  Team  was  on  duty  at  the  time  of  the 
accident,  and  many  of  the  Black  Team  members  were  in  Mission  Control 
preparatory  to  their  going  on  duty  about  an  hour  later. 


Position 

White 

Black 

Flight  Director 

E.  F.  Kranz 

G.  S.  Lunney 

Asst.  Fit.  Dir. 

J.  M.  Deeper 

L.  W.  Keyser 

RETRO 

B.  T.  Spencer 

T.  E.  Weichel 

FIDO 

W.  M.  St oval 

W.  J.  Boone 

GUIDO 

W.  E.  Fenner 

J.  G.  Renick 

EECOM 

S.  A.  Liebergot 

W.  C.  Burton 

GNC 

B.  N.  Willoughby 

J,  A.  Kamman 

TELMU 

R.  H.  Heselmeyer 

W.  M.  Merritt 

CONTROL 

L.  W.  Strimple 

H.  A.  Loden 

INCO 

G.  B.  Scott 

T.  L.  Hanchett 

PROCEDURES 

J.  R.  Fucci 

E.  W.  Thompson 

FAO 

E.  B.  Pippert 

T.  R.  Lindsey 

SURGEON 

W.  R.  Hawkins 

G.  F.  Humbert 
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PART  Cl 


TASK  ASSIGNMENT  AND  IMPLEMENTATION 


Panel  2 was  assigned  the  responsibility  of  reviewing  manufacturing 
and  testing  associated  with  spacecraft  equipment  involved  in  the  flight 
failure  as  determined  from  the  review  of  the  flight  data  and  the  analysis 
of  the  design.  In  particular , the  Panel  was  to  examine  discrepancies 
noted  during  the  fabrication,  assembly,  and  test  of  components  of  the 
oxygen  portion  of  the  cryogenic  gas  storage  system  within  the  service 
module  in  order  to  determine  any  correlations  between  such  preflight 
discrepancies  and  the  actual  inflight  events. 

Members  of  the  Panel  observed  actual  assembly  of  an  oxygen  tank 
and  the  oxygen  shelf  at  various  stages  of  assembly  at  the  contractor 
facilities  and  reviewed  documentation  relating  to  the  course  of  Apollo 
13  equipment  from  manufacturing  through  test  to  launch.  In  addition, 
the  Panel  reviewed  parts  and  material  qualification  data,  inspection 
reports,  reliability  and  quality  control  records,  and  preflight  test 
and  checkout  procedures  and  results.  Throughout  the  course  of  its 
review,  Panel  2 concentrated  on  determining  whether  manufacturing  or 
test  procedures  could  adversely  affect  reliable  conduct  of  flight.  The 
steps  in  the  manufacturing  and  testing  of  the  suspected  components  were 
studied  so  as  to  evaluate  various  equipment  acceptance  procedures. 
Finally,  the  Panel  attempted  to  relate  observed  flight  events  back  to 
individual  points  in  the  manufacturing  and  testing  process  in  order  to 
determine  if  any  correlation  was  probable. 


C-l 


This  page  left  blank  intentionally. 


C-2 


PART  C2 


ORGANIZATION 


Panel  2 was  chaired  by  Mr.  H.  M.  Schurmeier,  Jet  Propulsion 
Laboratory,  and  the  Board  Monitor  was  Dr.  J.  F.  Clark,  Goddard  Space 
Flight  Center.  Panel  members  were: 

Mr.  E.  F.  Baehr,  Lewis  Research  Center 

Mr.  K.  L.  Heimburg,  Marshall  Space  Flight  Center 

Mr.  B.  T.  Morris,  Jet  Propulsion  Laboratory 

Specific  assignments  covering  such  areas  as  subsystem  testing, 
fabrication  process,  and  reliability  and  quality  assurance  were  given 
to  each  Panel  Member.  In  reaching  Panel  conclusions,  however,  all 
Members  participated  in  the  weighing  and  evaluation  of  data. 
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PART  C3 


SUMMARY 


The  basic  tank  provides  a thermally  isolated  pressure  vessel  struc- 
ture that  is  relatively  straightforward  to  manufacture.  The  manufactur- 
ing process  has  reasonable  controls  and  provides  tanks  of  high  structural 
quality. 

The  manufacture  of  the  internally  mounted  equipment  is  somewhat 
more  complex  because  of  the  large  number  of  parts  that  are  required  to 
make  these  assemblies.  The  careful  use  of  jigs,  fixtures,  and  the 
detailed  Manufacturing  Operations  Procedures  (MOP)  adequately  controls 
these  steps  and  provides  hardware  fully  meeting  the  structural  design 
requirements  as  stated  on  the  engineering  drawings. 

The  most  noteworthy  manufacturability  shortcoming  of  the  design 
is  the  routing  of  the  wires  from  the  electrical  devices  within  the  tank. 
The  passageways  are  small,  adjacent  metal  corners  are  relatively  sharp, 
and  the  condition  of  the  insulation  cannot  be  inspected  after  assembly. 
The  assembly  process  is  very  difficult  and  even  though  detailed  MOP1 s 
are  provided  and  the  technicians  are  skilled  and  experienced  in  these 
operations,  the  resultant  product  is  of  questionable  quality  because  of 
the  many  opportunities  to  damage  the  insulation  on  the  wires.  Even  in 
the  assembled  condition,  the  wires  can  be  damaged  because  of  the  lack 
of  support  and  restraint  and  the  exposure  to  turbulent  fluid  during 
tanking,  detanking,  and  purging  operations. 

Another  notable  shortcoming  of  the  design  is  the  very  loose  toler- 
ances specified  for  the  tank  fill  tube  connecting  parts.  The  tolerance 
range  permitted  by  the  engineering  drawings  can  result  in  a fill  tube 
assembly  that  can  fall  out  of  place  if  the  parts  are  at  or  near  the  low 
tolerance  limits.  The  parts  cannot  be  assembled  if  their  size  averages 
much  larger  than  nominal.  Even  with  all  parts  of  the  fill  tube  assembly 
near  the  nominal  sizes  specified,  adequate  diametral  clearance  exists 
for  a sizable  gas  leakage  path. 

The  Globe  Industries,  Inc.,  fan  motors  have  had  a history  of  numer- 
ous problems.  Many  design  changes  were  introduced  to  overcome  these 
problems.  The  most  prevalent  problem  was  dielectric  breakdown  within 
the  stator  windings.  Process  changes  and  the  addition  of  300  volts  rms 
phase-to-phase  dielectric  tests  during  stator  assembly  greatly  reduced 
the  incidence  rate  of  this  problem. 

The  standard  acceptance  procedures  adequately  cover  all  functional 
requirements  for  normal  flight  use  but  do  not  check  the  ability  of  the 
heater  thermostats  (thermostatic  switches)  to  function  under  load, 
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nor  do  they  state  a requirement  for  proper  functioning  of  the  fill  tube 
assembly,  which  must  function  as  a dip  tube  during  detanking  operations. 

The  manufacturing  history  of  tank  no.  2 of  Service  Module  109 
( 1002UXTA0008)  before  delivery  from  Beech  was  unusual  only  to  the  extent 
that  the  tank  was  reworked  twice  after  initial  closure,  once  to  replace 
a heater  tube  assembly  including  both  motor  fans  and  once  to  replace 
pinch-off  tube  assemblies  used  in  evacuation  of  the  annulus  volume 
between  the  tank  shells . 

The  test  history  was  unusual  only  to  the  extent  that  the  high  but 
acceptable  heat  leak  characteristic  caused  months  of  delay  in  tank 
acceptance.  No  direct  evidence  of  any  particular  characteristic  of 
this  tank  at  delivery  from  Beech,  as  distinguished  from  any  other 
Block  II  oxygen  tank,  was  found  that  would  correlate  with  the  Apollo  13 
flight  accident. 

The  normal  procedure  at  the  conclusion  of  the  heat  leak  tests  at 
Beech  Aircraft  Corporation,  Boulder,  Colorado,  calls  for  expelling  the 
last  25  pounds  of  the  remaining  liquid  oxygen  through  the  "fill"  line 
by  applying  pressure  to  the  vent  line  with  gaseous  nitrogen.  Although 
the  tank  assembly  is  on  a weighing  system  which  has  a resolution  of 
0.3  pound,  and  the  procedure  calls  for  continuing  the  application  of 
vent  line  pressure  until  both  the  weighing  system  and  quantity  probe 
indicate  the  tank  is  empty,  no  data  were  recorded  that  verify  that 
remaining  oxygen  was  expelled  as  a liquid.  At  the  time  no  one  indicated 
that  the  response  of  the  tank  to  the  procedures  was  anything  but  normal, 
and  today  careful  review  of  existing  data,  discussions  with  the  responsible 
Beech  Aircraft  and  North  American  Rockwell  personnel,  and  a special  test 
at  Beech  Aircraft  indicates  that  the  detanking  of  the  0008  tank  was  most 
probably  normal. 

The  manufacturing  and  test  procedures  and  activities  for  inte- 
grating the  oxygen  storage  tanks  into  the  service  module  were  thoroughly 
detailed  and  closely  monitored  with  respect  to  procedures.  They  involved 
checkouts  with  dry  gas  only,  until  cryogenic  oxygen  reaches  the  tanks 
during  the  countdown  demonstration  test  (CDDT)  at  Kennedy  Space  Center  (KSC) 
a few  weeks  before  launch.  Between  the  tank  acceptance  and  CDDT  only 
pressure  vessel  integrity  and  electrically  observable  phenomena  of  the 
inner  tank  elements  are  tested.  No  tests  are  performed  to  check  the 
ability  of  the  thermostats  to  interrupt  either  the  spacecraft-supplied 
heater  power  (about  2.8  amps  at  28  V dc)  or  the  GSE  power  (about  6 amps 
at  65  V dc). 

In  August  1968,  oxygen  shelf  assemblies  at  North  American  Rockwell 
(NR),  Downey,  were  scheduled  to  be  modified  to  add  potting  to  the 
dc-to-dc  converters  of  oxygen  tank  vafc-ion  pumps  for  electromagnetic 
interference  prevention.  During  factory  procedures  with  the  oxygen 
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shelf  assembly  incorporating  tank  1002UXTA0008  in  the  tank  no.  2 position 
in  Service  Module  10 6 at  NR,  Downey*  a handling  fixture  incident  (ini- 
tiated by  failure  to  remove  an  unnoticed  shelf  bolt)  subjected  this  tank 
to  unexpected  jolts.  These  included  the  apparent  shelf  damaging  contact 
of  the  tank  with  the  fuel  cell  shelf  and  drop  of  the  tank  with  the  shelf 
to  the  normal  oxygen  mounts.  Such  elements  as  the  fill  tube  segments 
appear  vulnerable  to  this  incident.  No  record  of  investigation  into  the 
internal  condition  of  the  tank  other  than  pressure  and  electrical  circuit 
test  could  be  found.  Manufacturing  and  test  records  do  not  show  engineer- 
ing assistance  related  to  conditions  internal  to  the  oxygen  storage  tank. 

Service  Module  106  was  promptly  repaired  and  fitted  with  a different 
oxygen  shelf  already  modified  (ultimately  it  flew  as  Apollo  10 ) . The 
tank  and  the  oxygen  shelf  now  under  review  were  re-inspected  and  retested 
during  the  first  3 weeks  of  November  1968.  They  were  then  installed  in 
Service  Module  109  (used  in  the  Apollo  13  flight).  This  service  module 
was  completed,  tested,  and  checked  out  normally  thereafter,  so  far  as 
the  oxygen  system  was  concerned,  and  transported  to  KSC  in  mid-1969* 

During  integrated  test  and  checkout  at  KSC,  no  major  anomaly 
occurred  until  the  tank-emptying  phase  of  the  CDDT,  March  23,  1970. 

After  this  first  cryogenic  oxygen  loading  since  February  1967,  expulsion 
of  liquid  oxygen  through  the  "fill”  line  under  gas  pressure  applied 
through  the  vent  line  was  not  achieved.  Evidence  supporting  the 
assumptions  of  leakage  or  dislodgment  of  the  fill  line  segments  (two 
Teflon  elbows  and  one  short  Inconel  tube)  in  the  top  of  the  quantity 
probe  assembly  within  the  oxygen  tank  was  produced  at  KSC  in  the 
processes  of  emptying  the  tank. 

Special  methods  used  for  emptying  on  March  27  and  28,  1970,  and 
again  on  March  30,  involved  protracted  operation  of  the  tank  heaters 
and  fans  for  many  hours  and  at  maximum  heater  voltage.  In  conjunction 
with  this  heating,  cyclic  gas  pressurization  and  blowdown  was  used  to 
achieve  rapid  boiling  to  remove  oxygen  from  the  tank.  Analyses  of 
data  taken  during  the  early  portion  of  these  procedures  confirm  boiling 
as  sufficient  to  detank  the  observed  quantities. 

These  methods  were  not  supported  by  previous  comparable  operations 
with  any  other  Apollo  CSM  cryogenic  oxygen  storage  tank.  Thus  it  was 
not  demonstrated  separately  that  such  operation  could  be  accomplished 
without  degradation  or  hazard  in  the  subsequent  flight  use  of  the  tank. 

A review  of  all  the  evidence  available  indicates  that  this  tank 
(at  least  the  fill  line  segments)  most  probably  arrived  at  the  CDDT  in 
a different  condition  than  that  in  which  it  was  last  tested  at  Beech 
Aircraft  Corporation. 
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Tests  were  conducted  at  the  Manned  Spacecraft  Center  to  evaluate 
the  effects  of  the  sustained  heater  operation  during  the  special  de- 
tanking operation  at  KSC  on  March  27,  1970.  These  tests  demonstrated 
that  the  thermostats  would  weld  closed  when  they  attempted  to  interrupt 
the  5-9  amps,  65  volts  dc  GSE  power  (a  condition  for  which  they  were 
neither  designed  nor  qualified)  resulting  in  their  failing  to  limit 
the  temperature  inside  the  tank.  The  tests  also  showed  that  with  the 
heaters  on  continuously  and  as  the  cryogenic  liquid  boiled  away, 
temperatures  in  the  700°  to  1000°  F range  would  exist  on  portions  of 
the  heater  tube  in  contact  with  the  motor  wires.  These  temperatures 
severely  damaged  the  Teflon  insulation  even  in  the  nitrogen  atmosphere 
of  these  tests.  Small-scale  tests  subjecting  Teflon  insulated  wires 
to  700°  to  1000°  F temperature  oxygen  atmosphere  indicated  even  more 
severe  damage  to  the  Teflon  insulation. 

Therefore  it  is  reasonable  to  conclude  that  the  special  detanking 
procedures  employed  on  tank  0008  at  KSC  prior  to  launch  of  Apollo  13 
severely  damaged  the  insulation  of  the  motor  wiring  inside  the  tank. 

A more  complete  test  is  being  conducted  at  Beech  Aircraft, 

Boulder,  Colorado,  to  simulate  the  special  detanking  operations  used 
at  KSC  on  March  27-28  and  30,  1970.  This  test  will  utilize  a flight 
configuration  tank,  simulated  KSC  ground  support  equipment,  and  will 
be  conducted  using  oxygen. 
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PART  C-4 


REVIEW  AND  ANALYSIS 


MANUFACTURE  AND  ACCEPTANCE  TESTING 
OF  THE  CRYOGENIC  OXYGEN  STORAGE  TANKS 


The  cryogenic  oxygen  storage  tanks  are  manufactured  by  the  Beech 
Aircraft  Corporation,  Boulder  Division,  located  north  of  Boulder,  Colorado. 
The  tank  consists  of  a spherical  high-pressure  inner  vessel  wrapped  with 
multilayer  insulation  contained  within  a thin  external  metal  vacuum  jacket. 
Inside  the  pressure  vessel  are  a heater  and  fan  assembly  (two  heaters  and 
two  fans),  a quantity  measuring  probe,  and  a temperature  sensor.  Many  of 
the  parts  and  subassemblies  that  comprise  this  tank  are  purchased  by  Beech 
from  subcontractors  and  vendors  located  throughout  the  United  States. 

The  detailed  instructions  for  the  manufacture  and  assembly  of  these 
tanks  and  their  subassemblies  at  Beech  are  controlled  by  Manufacturing 
Operations  Procedures  (MOP).  In  addition  to  instructing  the  technicians, 
the  MOP  also  calls  out  the  presence  and  activities  of  the  inspectors. 


Summary  of  the  Standard  Tank  Manufacturing  Process 

The  inner  pressure  vessel  is  made  from  two  forged  hemispheres  of 
Inconel  718  alloy.  The  rough-machined  heat-treated  forgings  are  supplied 
by  the  Cameron  Iron  Works,  Houston,  Texas.  The  physical,  chemical,  and 
metallurgical  properties  (X-ray,  ultrasonic  scan,  and  microstructure)  of 
these  forgings  are  tested  and  certified  by  Cameron.  The  Airite  Division 
of  Electrodata  Corp.,  Los  Angeles,  California,  does  the  final  machining 
and  electron  beam  welding.'  Prior  to  welding  a very  thorough  inspection 
is  made  of  each  hemisphere.  About  450  thickness  checks  are  made  to  assure 
compliance  to  dimensional  accuracy  requirements.  Each  hemisphere  is 
thoroughly  X-rayed  and  dye-penetrant  inspected  for  defects.  The  internal 
parts  that  support  the  heater  probe  assembly  are  made  by  Beech  and  supplied 
to  Airite  for  installation  prior  to  making  the  electron  beam  equatorial 
weld.  A rather  elaborate  five-step  welding  process  is  used  in  making  this 
equatorial  weld  (figs.  C4-1  and  C4-2).  The  first  step  is  a series  of  tack 
welds.  The  second  step  is  a seal  weld  of  shallow  penetration.  The  third 
step  is  a deep-penetration  weld.  The  fourth  step  is  a shallower  and  wider 
weld  to  blend  surfaces.  The  fifth  weld  is  called  a cover  pass  which  is 
still  wider  and  shallower  for  final  surface  blending.  The  completed  vessel 
is  X-rayed  and  then  pressure  tested.  A hydrostatic  proof  pressure  of 

1557  psig  is  applied  for  5 minutes  using  water.  The  volumetric  ex- 
pansion during  the  proof-pressure  test  is  determined  by  measuring  the 
weight  increase  of  water  contained  within  the  test  specimen.  A leak  test 
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P/M 

thickness 

Tank  radius 

D imensions 

L 

T 

O.D. 

I.D. 

1.000 

+ .002 

.084 

14.808  refarc 

+005 
12.528  _0 

Sph  rad 

2.000 

+ .002 

.067 

14.808  refarc 

+005 
12.528  _0 

Sph  rad 

3.000 

+ 004 
•°59  _ 000 

12.587  refarc 

+005 
12.528  _0 

Sph  rad 

Weld  schedule  (Electron  beam  weld) 

Pass  sequence 

Parameter 

1-tack 

2-seal 

3-pene.  1 

4-pene  .2 

5-cover 

Voltage  - Kv 

80 

80 

115 

95 

85 

Amperes  - MA 

1.5 

1.5 

6.0 

4.0 

3.0 

Beam  deflection  - 
Travel  - in./ min 

in.  0.012 

18 

0.012 

.024/. 036 

.040/080 

0.110 

Vacuum  - mm  hg 

2X10-4 

Notes:  (1) 

0.002"  gap,  0.003"  offset  (max  typ) 

(2) 

No  weld  repairs  allowed 

(3) 

Typical  weld  sequence  shown  on  attached  sketch 

Figure  CU-1.-  Girth  weld  joint  configuration  and  schedule. 


C-10 


Figure 
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is  made  at  925  psig  ±15  using  helium.  These  tests  are  performed  by  the 
Beech  Test  Department  before  acceptance.  The  completed  vessels,  along 
with  substantiating  data,  are  shipped  to  Beech  for  assembly. 

The  inner  pressure  vessel  is  cleaned  for  oxygen  service  and  sealed 
in  plastic.  When  scheduled  for  application  of  insulation,  the  vessel, 
the  insulation,  and  the  other  necessary  piece  parts  and  supplies  are  moved 
to  a small  room  annex  to  an  area  known  as  the  Respectable  Room.  (The 
Respectable  Room,  its  annexes,  and  the  Ultra  Clean  Room  together  are 
known  as  the  Apollo  Assembly  Area. ) 

All  assembly  operations  performed  in  these  rooms  are  in  accord  with 
standard  clean  room  techniques,  i.e.,  lint-free  gowns,  caps,  and  gloves. 

A simple  entrance  airlock  has  a motorized  shoe  brush  and  vacuum  cleaner 
but  the  brushes  are  disabled  so  as  not  to  rotate  under  motor  power.  There 
is  no  air  scrub. 

The  insulation  is  applied  to  the  inner  vessel  in  gore  panels,  a layer 
at  a time.  The  insulation  consists  of  many  layers  of  Dexiglas  Insulation 
paper  (C.  H.  Dextar  & Son,  Inc.),  fiberglass,  mats,  aluminum  foil,  and 
aluminized  Mylar.  Each  layer  is  carefully  applied  to  the  vessel,  tem- 
porarily held  in  place  with  tape,  trimmed  for  fit,  and  then  finally  held 
in  place  by  thin  nylon  threads.  After  the  threads  are  in  place  the  tape 
is  removed.  The  joints  in  succeeding  layers  are  shifted  so  as  to  effec- 
tively block  the  flow  of  heat.  The  aluminum  foil  layers  are  checked  with 
an  ohmmeter  to  assure  no  electrical  contact  with  inner  vessel  or  adjacent 
foil  layers.  About  halfway  through  the  insulation  process,  a tube  is  in- 
stalled which  goes  from  the  vacuum  dome  area  to  the  equator,  around  the 
equator,  and  back  to  the  dome  area.  This  is  called  the  vapor  cool  shield 
(VCS).  (See  fig.  C4-3.  ) 

After  all  the  insulation  is  applied,  the  external  metal  jacket  is 
installed.  These  parts  are  made  by  Chemtronics,  Inc.  The  main  upper  and 
lower  hemispheres  are  deep  drawn  and  chem-milled.  The  equatorial  flange 
is  machined  from  a ring  forging  (fig.  C4-4).  All  parts  are  made  of 
Inconel  750  alloy.  An  assembly  of  the  lower  hemisphere  and  equatorial 
flange  is  made  by  Heli-arc  welding.  A shield  is  placed  over  the  in- 
sulation in  the  region  of  the  final  closure  weld  between  the  lower 
hemisphere-flange  assembly  and  the  upper  hemisphere  shell.  After  these 
parts  are  positioned  over  the  insulated  pressure  vessel,  the  circum- 
ferential weld  to  join  them  is  made  by  the  automatic  Heli-arc  welding 
process  using  argon  gas  for  inerting  the  weld  zone.  The  welds  in  the 
vacuum  jacket  are  then  X-ray  inspected  to  insure  integrity. 

Figure  C4-5  shows  the  major  subassemblies  required  to  complete  the 
oxygen  tank  assembly.  All  components  and  piece  parts  required  to  build 
subassemblies  are  cleaned  for  liquid  oxygen  service,  grouped  as  required 


C-12 


Inner  pressure  vessel 
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Figure  cU-3. 
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Figure  CU— 5 - — Major  subassemblies  required  for  tank  assembly. 
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for  each  subassembly  (kitted),  and  sealed  in  a clear  nylon  plastic  bag 
which  is  then  sealed  in  a clear  polyethylene  bag.  These  kits  are  stored 
for  the  subassembly  and  assembly  operations  which  are  performed  in  various 
rooms  of  the  Apollo  Assembly  Area. 

The  heater  and  fan  assembly  is  made  from  numerous  small  parts  welded, 
brazed,  riveted,  or  bolted  together  (fig.  CU-6).  The  first  operation  in- 
stalls the  lower  pump  nozzle  assembly  into  the  lower  motor  housing.  These 
parts  are  positioned  in  a jig  and  then  fusion  welded  in  place.  After  this 
weld  is  X-rayed,  the  part  is  turned  to  trim  the  inside  diameter  and  to 
assure  roundness.  The  lower  motor  housing  is  then  positioned  and  welded 
to  the  central  tube.  The  weld  zone  is  X-rayed  and  the  entire  assembly  is 
pickled  and  passivated.  The  two  helically  preformed  stainless-tube-encased 
ni chrome  heating  elements  are  then  slid  in  place.  Before  proceeding  the 
heaters  are  tested  for  resistance  and  isolation  from  ground.  The  upper 
motor  housing  tube  is  then  positioned  and  welded  to  the  central  heater 
tube.  After  this  weld  is  X-rayed,  the  heaters  are  positioned  and  silver 
soldered  in  position.  After  the  heater  tube  is  thoroughly  cleaned  to  re- 
move any  silver  solder  flux,  the  tube  (conduit)  that  routes  the  wires  from 
the  lower  motor  past  the  heater  elements  is  installed  by  riveting  the  two 
small  clips  to  the  inside  of  the  central  tube.  Small  aluminum  shims  are 
riveted  to  the  inner  surface  of  the  heater  tube  to  provide  a flat  surface 
for  the  mounting  of  the  thermostats.  The  unit  is  then  vacuum  baked  at 
200°  F to  remove  any  moisture  from  the  heater  assembly.  The  resistance 
and  insulation  tests  are  again  run  to  assure  that  the  brazing  has  not 
damaged  the  heaters  and  that  the  units  are  thoroughly  dry. 

At  this  point  the  heater  tube  is  ready  for  the  installation  of  the 
thermostats.  The  thermostats  are  purchased  from  the  Spencer  Thermostat 
Division  of  Metals  and  Controls,  Inc.,  Attleboro,  Massachusetts.  Each 
thermostat  is  subjected  to  detailed  acceptance  testing  by  Metals  and 
Controls,  Inc.,  and  these  data  are  supplied  to  Beech  with  the  serialized 
switches.  The  acceptance  testing  consists  of  a 1000  V ac  dielectric 
test  for  1 minute,  a visual  check  for  workmanship,  a dimensional  check 
to  drawing  size  callouts,  a 5-minute  soak  in  liquid  nitrogen,  the  open- 
ing temperature,  the  closing  temperature,  a second  5-minute  soak  in 
liquid  nitrogen,  a recheck  of  the  opening  temperature,  a recheck  of  the 
closing  temperature,  a leak  test  to  check  hermetic  seal,  a megohm  test, 
the  final  inspection  marking,  a recording  of  number  of  cycles  on  the 
unit  as  shipped,  the  actual  weight  of  unit,  and  visual  packing  and  ship- 
ping inspection.  Throughout  all  testing  by  Metal  and  Controls,  the 
thermostats  are  checked  by  using  6.5  V ac  and  a small  lamp  drawing  ap- 
proximately 100  milliamps.  Incoming  inspection  at  Beech  is  limited  to 
a visual  examination. 

The  thermostats  are  inserted  into  the  tube  with  their  hook-type 
terminals  extending  to  the  outside  of  the  heater  tube  and  bolted  in 
place.  This  heater  tube  assembly  is  then  cleaned  and  bagged  for  future 
assembly  operations . 
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Figure  CU-6.-  Heater  tube  assembly. 


The  electric  motor  fans  are  purchased  from  Globe  Industries,  Inc. 
These  motors  go  through  a thorough  acceptance  test  at  Globe  before 
delivery  to  Beech.  In  addition  to  the  normal  visual  and  mechanical  in- 
spection, the  motors  are  functionally  tested  at  both  ambient  and  cryo- 
genic conditions.  A 1000  V dc  dielectric  strength  test  is  applied  be- 
tween the  windings  and  case.  The  isolation  must  be  at  least  2 megohms. 
The  motor  is  then  operated  on  115  V ac  400  cycles,  and  the  following 
characteristics  are  measured  and  recorded:  (l)  speed  and  current  of 

motor  when  operating  with  a calibrated  test  fan,  and  (2)  line  current 
and  total  power  both  running  and  still.  The  motors  are  then  operated  in 
liquid  nitrogen.  These  checks  are  limited  to  assuring  that  the  motor 
starts  and  runs  smoothly  and  that  coastdown  time  is  at  least  30  seconds. 

At  Beech  the  normal  visual  incoming  inspection  was  performed  and 
then  these  parts  were  stored  until  ready  to  be  incorporated  into  the 
heater  and  fan  assembly. 

The  kits  of  parts  and  components  required  for  the  heater  and  fan 
assembly  are  moved  to  an  annex  room  of  the  Respectable  Area  where  this 
assembly  operation  is  performed  on  a laminar  flow  bench.  The  necessary 
tools  are  cleaned  and  laid  out  for  ease  in  the  assembly  process.  An 
assembly  aid  is  used  to  support  the  fan  and  heater  tube  In  the  hori- 
zontal position. 

The  lower  electric  motor  is  now  installed.  The  electrical  leads 
are  provided  by  the  motor  supplier  (four  26-gage  nickel  with  Teflon 
insulation  twisted  10  turns  to  the  foot  with  a 2-inch-long  Teflon  sleeve 
adjacent  to  the  motor)  (fig.  04-7)-  These  leads  are  routed  parallel  to 
the  motor  shaft  through  a shallow  groove  milled  half  In  the  motor  end 
cap  and  half  in  the  motor  support  tube  (figs.  C4-8  and  C4-9).  From 
this  channel  the  wires  are  routed  against  the  inner  surface  of  the 
motor  tube  In  the  region  of  the  impeller.  The  wires  then  emerge  through 
a hole  in  the  motor  housing  tube  (ungrommeted) . The  motor  is  inserted 
in  the  end  of  the  tube  (fig.  04-10)  and  the  motor  end  plate  is  installed. 
Shims  are  used  as  required  under  this  motor  end  cap  to  provide  0.030-inch 
to  0.040-inch  end  clearance  between  the  impeller  and  the  nozzle.  When 
the  proper  shims  are  selected  and  installed,  the  four  end  cap  screws 
are  toraued  to  the  required  value  (fig.  C4-11).  The  end  cap  is  bolted 
to  the  support  tube  by  four  radial  countersunk  machine  bolts,  small 
segment-shaped  shims,  and  self-locking  nuts  (all  metal). 

When  the  location  of  the  lower  motor  is  verified  as  having  the 
correct  impeller-to-nozzle  clearance,  the  wire  routing  task  continues. 

The  wires  travel  axially  about  2 inches  (fig.  04-12)  where  they  go  in- 
board through  a Teflon  grommet  into  the  inner  conduit  and  travel  the 
length  of  the  heater  section  to  a symmetrical  location  where  they  again 
emerge  to  the  exterior  through  a Teflon  grommet.  A single  insulated 
wire  is  used  to  pull  the  motor  leads  through  this  conduit  route. 
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Figure  C4-7.-  Motor  fan  with  long  lead  wires. 
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Figure  cU-8.-  Installing  motor  lead  wires. 
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Figure  c4-9*~  Installing  lower  fan  motor 
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igure  C4-10.-  Installing  lower  fan  motor  showing  wire  rout  in. 
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-11.-  Tiphteninp  the  motor  end  cap  bolts  to  establish  the  proper  torque 
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Figure  CU-12 . - Installing  lower  motor  lead  wires  in  heater  conduit 


The  installation  of  the  upper  motor  follows  the  same  general  sequence 
except  that  once  the  leads  emerge  from  the  tube  they  do  not  reenter  the 
heater  tube  but  remain  as  a twisted  bundle  of  four  wires  encased  in  a 
Teflon  sleeve. 

Next  a small  copper  band  is  formed  around  the  upper  and  lower  motor 
wire  bundles  in  the  areas  where  the  impellers  of  the  fans  are  located  to 
assure  that  the  wires  maintain  the  required  clearance  with  the  impellers 
(approximately  0.030  inch)  (figs.  CU-13  and  CU-lU).  The  ends  of  these 
bands  are  sweat  soldered  together  to  retain  the  wires.  The  motor  leads 
external  to  the  heater  tube  are  then  encased  in  Teflon  shrink  tubing. 

White  tubing  is  used  for  the  lower  motor  leads  and  clear  tubing  is  used 
for  the  upper  motor  leads. 

The  leads  are  then  installed  for  the  heaters.  One  wire  from  each 
heater  is  soldered  to  its  thermostat.  The  lead  wires  (20-gage  silver- 
plated  copper  with  Teflon  insulation)  are  soldered,  one  to  the  other 
terminal  of  the  thermostat  and  the  other  wire  to  the  second  lead  of  the 
ni chrome  heater  element.  Separate  leads  (four  total;  two  for  each 
heater)  are  provided  to  extend  to  the  electrical  connector  fitted  out- 
side the  dome  at  the  top  of  the  vacuum  jacket.  Again  a cleaning  operation 
is  performed  to  remove  any  solder  flux.  Standard  60-percent  tin  and 
40-percent  lead  solder  is  used  for  all  electrical  connections. 

The  entire  heater  and  fan  probe  assembly  is  subjected  to  a detailed 
component  acceptance  test  to  assure  proper  operation.  The  unit  is  placed 
in  a controllable  temperature  oven.  Starting  from  about  100°  F,  the 
oven  temperature  is  slowly  lowered  until  the  closing  of  each  heater  therm- 
ostat is  noted  by  means  of  a Wheatstone  bridge.  While  in  this  closed 
position,  the  resistance  value  of  each  heater  element  is  measured  and  re- 
corded. The  oven  temperature  is  then  slowly  raised  to  detect  the  opening 
temperature  for  each  thermostat.  With  the  unit  removed  from  the  oven, 
the  resistance  value  of  each  motor  winding  is  measured  and  recorded.  The 
heaters  and  motors  are  subjected  to  a dielectric  strength  test  at  500  V dc 
with  a maximum  allowable  leakage  current  of  0.25  milliamps  permitted. 

The  insulation  resistance  of  both  heaters  and  both  motors  is  measured  and 
must  indicate  a minimum  of  2 megohms  isolation.  The  proper  operation  of 
the  motors  is  verified  in  two  vertical  orientations  at  full  voltage  and 
at  two  vertical  and  one  horizontal  orientations  at  reduced  voltage 
(80  ± 2 V ac).  The  time  in  tenths  of  hours  and  number  of  motor  starts  are 
recorded  for  each  test  sequence  and  this  is  added  to  the  previous  history 
for  continuity.  The  entire  assembly  is  then  cleaned  for  liquid  oxygen 
service,  bagged,  and  stored  for  future  use. 

The  upper  coil  assembly  as  shown  on  figure  C1+-5  consists  of  five 
coiled  tubes  to  provide  the  necessary  resistance  in  the  heat  flow  path, 
an  adapter  to  fit  the  tank  neck,  a seal-off  plate  for  the  side  of  the 
coil  housing  (vacuum  dome),  end  fittings  for  the  feed  lines  (that  connect 
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Figure  C4-13.-  Inserted  copper  band  to  retain  motor 


to  the  vapor  cool  shield)  , and  a connector  adapter  fitting.  These  tubes 
are  formed  by  a subcontractor  in  Denver.  The  material  for  all  tubes  is 
Inconel  750.  All  bending  is  performed  using  a flexible  chain  mandrel  of 
Ampco  bronze  and  Ucon  lubricant  (water  soluble).  The  various  piece  parts 
are  carefully  cleaned  and  jigged  for  Heli-arc  welding  into  an  assembly. 

The  supply  line  filter  is  installed  and  safety  wired.  The  assembly  is 
X-rayed,  recleaned,  and  bagged  for  future  use. 

The  quantity  probe  is  a purchased  item  which  is  procured  from 
Simmonds  Precision  complete  with  leads  and  temperature  sensor  installed 
with  leads  attached  (fig.  Ch-15 ) . This  unit  is  made  of  two  concentric 
aluminum  tubes  for  the  capacitance -type  quantity  (density)  probe  with 
Teflon  spacer  buttons  located  in  drilled  holes  in  the  inner  tube  to  pro- 
vide centering  action.  The  lower  ends  of  the  concentric  tubes  terminate 
in  a glass-filled  Teflon  bushing.  This  bushing  acts  as  a lower  pilot 
support  and  also  provides  a nonconducting  extension  of  the  inner  tube 
which  is  also  utilized  as  a dip  tube  for  the  filling  and  detanking 
operations.  The  axial  relationship  of  the  inner  and  outer  aluminum 
tubes  is  controlled  by  a single  rivet  installed  through  Teflon  bushings 
near  the  upper  end  of  the  assembly. 

The  upper  end  of  the  outer  aluminum  tube  is  supported  in  a large 
glass-filled  Teflon  bushing  which  is  riveted  to  an  Inconel  tube  for  final 
support  to  the  tank  adapter.  This  upper  bushing  has  two  axial  holes  to 
provide  routing  for  the  motor  and  heater  leads.  The  temperature  sensing 
element  is  mounted  on  the  side  of  this  bushing.  Axially  aligned  pins 
through  two  O.W-inch  cross-drilled  holes  are  used  as  junction  points  be- 
tween the  short  leads  from  the  temperature  sensor  and  the  W-inch-long 
extension  leads.  Two  22-gage  wires  are  used  for  each  extension  lead  of 
the  sensor  (a  total  of  four  wires).  The  capacitance  element  leads  consist 
of  a shielded  20-gage  wire  for  the  inner  tube  and  an  unshielded  20-gage 
wire  for  the  outer.  Two  channel-shaped  clips  are  riveted  to  the  upper 
ends  of  the  aluminum  tubes  to  solder  the  lead  wires  on.  The  quantity 
sensor  leads  are  encased  in  a clear  Teflon  shrink  sleeve.  The  temperature 
sensor  leads  are  encased  in  a separate  clear  Teflon  shrink  sleeve.  All 
solder  joints  are  made  with  60-percent  tin,  40-percent  lead  solder. 

After  incoming  inspection  of  this  Simmonds -manufactured  assembly 
verifies  conformance  to  the  purchase  specifications,  the  unit  is  cleaned 
for  liquid  oxygen  service,  bagged,  and  stored  for  future  use. 

The  parts  required  for  the  complete  assembly  of  the  quantity  probe 
are  then  drawn  from  storage.  The  first  operation  is  the  installation  of 
two  insulated  pull  wires  through  the  holes  provided  in  the  quantity  probe 
to  route  the  heater  and  motor  leads.  The  quantity  probe  wires,  temperature 
sensor  wires,  and  two  pull  wires  are  pulled  through  the  electrical  conduit 
by  first  pushing  a single  wire  through.  All  wires  are  attached  to  this 
pull  wire  to  be  pulled  into  the  conduit  (figs.  Ch-1 6 through  CU-19).  The 
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Vent  line  and  electrical 


Figure  CU-15.-  Cross  section  of  quantity  probe. 
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"are  Ck  -11 . - Pull  inf r quantity  probe  wires  into  upper  coil  assembly 
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Figure  C4-18.-  View  showing  the  feeding  and  pulling  used  to  install  wires. 
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next  items  to  install  are  the  Teflon  adapters  and  the  connecting  tube 
for  the  fill  tube  (figs.  Ck-20  through  Cb-22) . With  these  parts  in 
place,  the  quantity  probe  is  bottomed  in  the  counter-bore  of  the  tank 
tube  adapter  (fig.  C4-23)-  The  fill  tube  parts  are  then  checked  to 
assure  that  they  are  in  the  proper  position  by  use  of  a blunt  probe 
through  the  side  holes  in  the  outer  tube  (fig.  C4-24).  The  electrical 
feedthrough  holes  are  aligned  by  eye  with  the  electrical  conduit  and 
the  entire  unit  is  clamped  into  a jig  for  welding  (figs.  C4-25  through 
CU-27).  Four  l/k  -inch-long  welds  are  positioned  away  from  wires  and 
the  Teflon  fill  tube  adapter  to  secure  the  assembly  (figs.  C4-28  and 
CU-29 ) • The  Unit  is  then  inspected,  cleaned,  and  bagged  for  future 
assembly  into  the  tank. 

Prior  to  final  assembly  of  the  tank,  all  major  subassemblies  are 
subjected  to  component  acceptance  tests.  Specifically  these  major 
components  are  the  following:  pressure  vessel,  motor  heater  fan  assembly, 

coil  assembly,  probe  assembly,  and  the  electrical  connector.  These 
tests  check  all  functional  aspects  that  are  possible  at  that  level  of 
assembly,  electrical  isolation,  pressure  integrity,  etc.,  as  appropriate 
for  particular  components.  These  components  are  then  moved  to  an  area 
referred  to  as  the  Ultra  Clean  Room  (a  class  100,000  laminar  flow  clean 
room)  for  the  final  assembly.  Operations  in  this  area  are  performed 
in  full  lint- free  nylon  suits,  boots,  caps,  and  rubber  gloves.  Entry 
to  this  clean  room  is  from  the  Apollo  Assembly  Area  with  a simple  dress- 
ing room  airlock  for  changing  clothes.  All  equipment  moves  into  and 
out  of  the  area  through  airlocks. 

The  actual  final  assembly  starts  with  opening  the  tank  by  removing 
the  temporary  shipping  plug  from  the  tank  neck  (fig.  C4-30).  Through- 
out the  entire  assembly  operation,  a vacuum  cleaner  nozzle  is  positioned 
adjacent  to  the  tank  to  help  reduce  the  possibility  of  dust  or  lint 
entering  the  tank.  The  heater  assembly  is  then  lowered  part  way  into 
the  tank  (figs.  C4-31  and  C4-32).  With  the  assembly  held  about  halfway 
into  the  tank,  the  wires  are  fed  in  beside  the  heater  until  they  are 
completely  inside  the  tank.  The  heater  is  then  lowered  until  the  lower 
motor  adapter  pin  is  in  the  lower  support  bracket  (fig.  C4-33).  The 
last  portion  of  this  lowering  is  accomplished  by  use  of  duckbill  pliers 
(fig.  C4-34).  The  top  portion  is  then  positioned  for  the  upper  bolt 
to  be  installed.  The  bolt  is  inserted  by  means  of  a wire  holding  loop 
and  started  by  hand  (figs.  C4-35  and  04-36).  This  bolt  is  tightened 
with  an  open-end  wrench  with  final  torquing  achieved  by  a combination 
of  the  open-end  wrench  and  a standard  torque  wrench.  The  torque  value 
is  adjusted  to  account  for  the  combined  lever  arm  effect  of  the  wrenches. 
At  this  point  the  wires  are  fished  from  the  tank  with  hook  (fig.  C4-37)* 
The  wires  are  then  checked  and  any  tangles  are  removed.  A small  stain- 
less safety  wire  is  attached  to  the  wires  and  they  are  lowered  into 
the  tank  again  (fig.  C4-38). 

Next  a probe  support  fixture  is  attached  to  the  tank  neck  and  the 
probe  is  lowered  about  two  thirds  of  the  way  into  the  tank  (fig.  04-39)- 


C-33 


Figure  CU-20.-  Fill  tuoe  connecting  parts. 
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Figure  C4-21.-  Installing  fill  tube  connecting  parts. 
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Figure  04-22.-  Folding  fill  tube  connecting  parts  in  place. 
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Figure  C-4.23  - Final  mating  of  quantity  probe  and  tank  adapter. 
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Figure  cU-24.-  Probing  to  assure  that  fill  tube 
are  in  proper  position. 


C-4o 


Figure  cU-25.-  Quantity  probe  and  coil  assembly  in  welding  jig. 
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Figure  CU-26.-  Final  inspection  of  fill  tube  connecting  parts. 
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Figure  C4-27.-  Marking  the  weld  positions. 
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Figure  C4-29.-  The  completed  quantity  prohe  to  coil  assembly  welds. 
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Figure  C4-32--  Feeding  vires  into  tank 
beside  heater  probe. 


Figure  C4-33--  View  inside  tank  showing  heater 
probe  in  lower  support. 
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Figure  cU-jJt*.-  Wire  loop  used  to  install 
heater  probe  retaining  bolt. 
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Figure  C4-36.-  View  inside  tank  showing  heater  probe 
upper  retaining  bolt. 
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gure  cU-38.-  Lowering  wires  into  tank  with  fixture 
to  hold  quantity  probe  installed. 


Figure  C4-39.-  Quantity  probe  being  installed  in  fixture 
and  heater  probe  wires  being  pulled  from  the  tank. 
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At  this  point  the  wires  are  once  again  withdrawn  from  the  tank.  Again 
any  possible  tangles  are  removed.  Then  the  pull  wires  previously  in- 
stalled in  the  probe  are  soldered  to  the  motor  and  heater  lead  bundles. 
The  solder  joints  are  thoroughly  cleaned  and  taped  to  made  a smooth 
transition  from  each  single  pull  wire  to  each  bundle  of  six  leads. 

These  wire  bundles  are  pulled  into  the  conduit  one  bundle  at  a time 
with  one  man  feeding  the  wires  at  the  feedthrough  hole  in  the  quantity 
probe  and  the  other  man  pulling  approximately  25  to  35  pounds  on  the 
pull  wire  (figs.  C4-40  through  C4-42).  The  bundles  are  pulled  through 
until  the  slack  is  taken  out  of  the  wire  bundle  with  the  probe  in  this 
elevated  position  (about  9 inches  of  slack  when  probe  is  lowered  into 
into  tank)  (fig.  04-43)*  Then  holding  the  probe  assembly,  the  fixture 
is  removed  from  the  tank  neck  and  the  probe  is  lowered  into  the  tank 
(fig.  C4-44).  The  probe  assembly  is  then  rotated  counterclockwise 
approximately  one  turn.  The  unit  is  then  very  carefully  rotated  clock- 
wise to  start  the  quadruple  thread  and  pilot  the  lower  end  of  the  probe 
into  the  ring  provided  at  the  bottom  of  the  tank.  If  the  probe  assembly 
in  the  tight  position  does  not  result  in  alignment  of  the  supply  tube, 
then  the  probe  assembly  is  re-indexed  in  90-degree  increments  to  achieve 
alignment.  These  procedures  are  carried  out  to  a specific  Manufacturing 
Operations  Procedure  and  in  the  presence  of  quality  control  inspectors. 
(Figures  C4-45  and  C4-46  show  the  typical  routing  of  wires  from  the 
heater  and  fan  probe  assembly  into  the  quantity  probe.) 

The  electrical  connector  is  then  installed  so  that  a complete 
checkout  can  be  performed  on  the  electrical  operations.  The  lead  wires 
are  cut  about  3 inches  beyond  the  connector  adapter  flange.  At  this 
point  a 3-inch  length  of  large-diameter  Teflon  sleeving  is  installed 
in  the  neck  of  the  conduit.  About  2 inches  is  slid  into  the  conduit 
with  about  1 inch  protruding  into  connector  space.  The  wires  are 
thermally  stripped,  tinned,  and  soldered  into  the  connector.  After  a 
thorough  cleaning  with  alcohol,  the  connector  is  inspected  with  black 
light  to  assure  complete  removal  of  flux.  After  the  resistance,  isola- 
tion, and  functional  tests  are  completed,  the  metal  sleeve  is  slid  in 
place  and  welded.  The  connector  proper  is  protected  during  the  welding 
process  by  a set  of  copper  chills  which  have  cooled  in  liquid  nitrogen. 
Even  so,  the  weld  is  made  in  a series  of  short  segments  to  limit  the 
heat . 


The  next  operation  is  the  welding  of  feed  line  connections  and 
the  tank  neck  adapter.  A helium  leak  test  is  run  on  the  weld  joints 
using  a mass  spectrometer  leak  detector.  After  satisfactory  comple- 
tion of  these  checks,  the  welds  are  all  X-rayed. 

Next,  insulation  is  installed  in  the  vacuum  dome  area.  Two  layers 
of  aluminized  Mylar  are  applied  over  the  outer  shell  material  that 
extends  under  the  dome.  The  tank  adapter  flange  is  covered  with  four 
layers  of  aluminized  Mylar.  All  the  tubes  in  the  dome  area  are  wrapped 
with  1-inch  aluminized  Mylar  strips  held  in  place  with  nylon  thread. 
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Figure  CU-UO,-  Pulling  first  bundle  of  heater  and  fan  motor  leads 

into  upper  coil  assembly. 
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into  upper  coil  assembly. 
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Figure  C4-42.-  First  bundle  of  heater  and  fan  motor  leads  pulled 

through  upper  coil  assembly. 


Figure  C4-44.-  Lowering  quantity  probe 
assembly  into  tank. 
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Figure  C-U.U5  - View  inside  of  tank  of  typical  wire  routing 
from  heater  probe  to  quantity  probe  „ 
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Figure  C-4.46  - View  inside  of  tank  of  typical  wire  rout in 
of  heater  probe  wires  into  quantity  probe  . 
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The  coil  housing  (dome)  cover  is  now  welded  in  place.  The  housing 
contains  the  vacuum  pumpdown  tube,  the  blowout  disc,  and  the  vac-ion 
pump  bracket  (fig.  CU-Vf).  In  addition,  a pumpdown  tube  is  welded  to  the 
lower  hemisphere  to  speed  the  pumping  process.  After  the  welds  are  X- 
rayed,  a preliminary  pumpdown  is  made. 

After  a check  is  made  to  insure  vacuum  integrity,  the  vacuum  is  broken 
and  additional  insulation  is  stuffed  into  the  dome  area  through  the  vacuum 
pumpdown  tube.  This  insulation  consists  of  UO  square  feet  of  0.0005-inch 
gold-coated  Kapton  which  has  been  crinkled  and  cut  into  small  pieces  with 
pinking  shears.  (This  represents  about  5760  individual  pieces  approxi- 
mately 1-inch  square  with  pinked  edges.  This  represents  2.3  ounces  of 
Kapton.  ) 

The  actual  pumpdown  is  accomplished  in  an  oven  at  190°  to  220°  F to 
speed  the  pumping  and  to  assure  a low  final  pressure.  Because  of  the  many 
layers  of  insulation,  a complete  pumpdown  requires  20  to  28  days.  At  the 
completion  of  the  pumpdown,  the  vacuum  pumpdown  tubes  are  pinched  and 
sealed  and  protective  caps  are  installed.  The  installation  of  the  vac-ion 
pump  completes  the  fabrication  process  of  the  tank  assembly. 


Acceptance  Testing 

End-item  acceptance  testing  is  a long  and  elaborate  process  controlled 
by  a detailed  written  test  procedure.  The  sequence  consists  of  the 
following:  (l)  A dielectric  strength  test  of  the  following  wires  or 

groups  of  wires  shorted  together.  The  test  is  run  at  500  V dc  and  leak- 
age current  to  ground  (tank  assembly)  shall  not  exceed  0.25  milliamp; 
the  four  temperature  sensor  wires,  the  quantity  gage  outer  tube  lead, 
the  quantity  gage  inner  tube  lead,  the  quantity  gage  inner  tube  lead 
shield,  the  eight  wires  from  the  two  fan  motors,  the  four  wires  from  the 
two  heaters,  and  the  low-voltage  input  wires  to  the  vac-ion  pump;  (2) 
Dielectric  strength  test  of  vac-ion  converter  output  to  ground  (tank 
assembly)  at  i+00  V dc.  Leakage  shall  be  no  more  than  0.8  milliamp;  (3) 
Insulation  resistance  test  to  check  that  every  wire  or  group  of  wires 
that  should  be  isolated  from  other  wires  or  ground  shows  a minimum  of 
2 megohms  isolation  at  500  V dc;  (U)  The  isolation  between  the  vac-ion 
pump  electrical  terminals  and  ground  is  tested  at  500  V dc  and  must  be  at 
least  50  megohms;  (5)  The  isolation  between  the  vac-ion  converter  elec- 
trical output  terminals  and  the  tank  assembly  (ground)  is  tested  at 
500  V dc  and  must  be  50  megohms  or  greater;  (6)  The  vac-ion  pump  is 
functionally  tested;  (7)  The  inner  vessel  is  pumped  down  for  k hours  to 
assure  that  the  inner  vessel  is  dry;  (8)  Helium  leak  test  at  500  psi  and 
a helium  proof-pressure  test  at  1335  ± 20  psi;  (9)  A heater  pressurization 
test  and  heat-leak  test  (vessel  filled  with  liquid  oxygen  and  65  V ac 
supplied  to  heaters);  (10)  Cryogenic  proof-pressure  test  at  1335  1 20  psi 
(heaters  powered  by  65  V ac  to  raise  pressure  of  liquid  oxygen); 


Weld  seal-off  assemblies 


Install  and  weld  coil  housing  cover 


Install  elect  conn  sleeve 


Weld  seal-off  assemblies 


Figure  CU-U7.-  Final  vacuum  closure  operations. 
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(ll)  Heat-leak  test;  (12)  Inerting  of  the  vessel  with  100°  to  160°  F 
nitrogen  gas;  (13)  Check  to  see  that  thermostats  are  open  when  nitrogen 
purge  temperature  of  100°  to  110°  F flows  from  exit  of  tank  (30  V ac 
applied  momentarily  to  verify  that  thermostats  are  open);  (l4)  Vac-ion 
pump  final  functional  test;  and  (15)  Final  motor  run  verification  and 
coastdown.  The  heat-leak  tests  consist  of  many  runs  to  cover  a range  of 
ambient  conditions  and  outflow  rates.  Total  testing  involves  40  to  60 
hours  with  liquid  or  supercritical  oxygen  in  the  tank.  Data  sheets  on 
cryogenic  performance  specified  in  the  procedure  are  furnished  to  North 
American  Rockwell  in  the  end-item  acceptance  data  package  which  accom- 
panies each  tank  on  delivery  to  North  American  Rockwell. 

At  the  conclusion  of  the  heat- leak  test,  approximately  100  pounds 
of  oxygen  remain  in  the  tank  which  must  be  emptied  and  purged  for  de- 
livery. Approximately  three- fourths  of  the  mass  of  oxygen  in  the  tank 
is  released  from  the  tank  through  the  supply  line  in  the  process  of 
reducing  tank  pressure  from  the  initial  925-935  psia  to  the  final  pres- 
sure of  25-35  psia.  To  complete  emptying,  the  portion  of  this  oxygen 
which  remains  liquid  after  the  pressure  bleeddown  is  expelled  through 
the  fill  line.  The  application  of  warm  gas  at  30  psia  through  the  vent 
line  to  accomplish  this  expulsion  approximates  the  normal  detanking  pro- 
cedure used  by  KSC  at  the  completion  of  the  CDDT.  The  CDDT  is  the  next 
time,  after  delivery  of  the  tank  by  Beech  Aircraft  to  North  American, 
that  cryogenic  oxygen  is  loaded  into  and  expelled  from  each  tank. 


Summary  of  Significant  Aspects  of  the  Manufacture  and  Acceptance 
Test  of  Cryogenic  Oxygen  Storage  Tank  Serial  No.  10024XTA0008 

The  manufacturing  and  test  flow  for  cryogenic  oxygen  storage  tank 
serial  no.  10024XTA0008  is  shown  in  figure  C4-48.  The  item  of  particular 
significance  is  the  recycle  that  was  required  in  the  manufacturing 
process  brought  on  by  motor  failures. 

The  manufacturing  history  of  the  fan  motors  installed  before  or 
during  1966  contains  many  incidents  of  failures  encountered  in  motor 
tests  which  resulted  in  design  or  fabrication  process  changes.  The 
failure  modes  experienced  were  categorized  as: 

(a)  Contamination  failures 

(b)  Bridge  ring  (stator  laminations)  failures 

(c)  Bearing  failures 

(d)  Phase-to-phase  (stator  windings)  dielectric  breakdown  or  shorts 


(e) 

Grounds  (of  stator 

wiring) 

(f) 

Lead  wire  damage  (primarily  at 

Beech) 

(g) 

(Motor  fan)  speed 

(h) 

Coast down  failures 

(less  than 

30  s e c on ds  in 

ai r or  gas ) 


Design  and  manufacture  process  changes  to  minimize  the  effect  of 
some  of  these  failure  modes  were  initiated  during  Block  I motor  manufac- 
ture. Most  others  were  initiated  before  the  motors  used  in  tank  1002UXTA0008 
were  assembled  at  Globe  Industries.  Failure  mode  (d)  was  the  basis  for 
the  most  recent  changes  affecting  these  particular  motors.  Corrective 
actions  to  employ  extreme  care  in  stator  winding  and  to  use  phase-to- 
phase  dielectric  checks  at  300  V rms  were  incorporated  in  the  winding 
process.  These  were  followed  by  a phase-to-phase  dielectric  check  at 
250  V rms  after  the  winding  was  complete  and  before  the  terminals  were 
soldered.  Effectivity  of  these  actions  caught  the  lower  motor  in  re- 
work and  the  upper  motor  in  original  stator  winding.  After  installation 
of  the  heater  tube  assembly,  including  the  motor  fans,  Beech  tested  the 
motor  wiring,  shorted  together,  with  500  V dc  to  ground. 

A listing  of  the  inspection  discrepancies  issued  against  serial 
no.  1002UXTA0008  are  listed  in  table  CU-I.  In  the  Beech  nomenclature 
these  discrepancies  are  known  as  Withholding  Forms.  As  stated  previously, 
the  motor  problem  is  considered  the  significant  item.  The  heat-leak 
problem  was  not  considered  serious  because  many  missions  required  use 
rates  above  the  minimum  flow  capability  of  tank  0008. 


The  oxygen  storage  tank  assembly  is  normally  handled  and  tested  at 
Beech  Aircraft  in  the  upright  position.  Vertical  motions  may  compact  the 
tube  set  to  minimum  length  so  as  to  contribute  to  dislodgment  by  minimizing 
overlap  with  the  upper  stub  tube  nipple  of  the  tank  adapter. 

Shortly  before  shipment  from  Beech,  the  tank  is  rotated  (tumbled) 
while  in  a handling  fixture,  "to  determine  if  all  parts  are  secure."  Since 
this  is  the  only  known  source  of  side  forces  applied  to  the  fill  tube  com- 
ponents and  since  the  detanking  was  apparently  normal  in  the  Beech  tests, 
it  lends  evidence  to  the  assumption  that  the  fill  tube  components  were  in 
the  proper  position  at  that  time. 


Investigation  of  Manufacturing  Process  and  Supporting  Analysis 

To  gain  a first-hand  appreciation  of  the  manufacturing  process,  a 
visit  was  arranged  to  the  Beech  Aircraft  Corporation,  Boulder  Division, 
to  observe  key  assembly  operations.  In  addition  to  a detailed  discussion 
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Figure  C^-U8.-  Manufacturing  and  test  flow  for  the  oxygen  tank  at  Beech. 


TABLE  C4-I . - WITHHOLDING  FORMS  (INSPECTION  DISCREPANCIES) 


Disposition 

Acceptable  as  is 

Acceptable  as  is 

Grind  out  and  re we Id 
X-ray  and  leak  check 

Machine  to  print 

Replace 

Scrap  valve 

Replace 

Replace 

Return  to  vendor 
Not  acceptable 

Return  to  vender 

for  repair  or  replacement 

Replace 

Misinterpretation  - shadow 
was  thought  to  be  contamina- 
tion 

Waiver  approved 
April  19,  1967 

Reason 

Oversize  rivet  hole 

0.132  to  0.128  diameter,  0.006  inch  oversize 

CO 

g 

cd 

CO 

<u 

ft 

O 

.G 

O 
ON 
( — 1 

d g 
0 

0 p 
P OJ 

S 

O cd 
CO  -H 
rH  TJ 

d 0 

N"\ 
O CM 

d 

Two  oversize  pieces  of 
porosity 

Out  of  tolerance  condition 
in  clamp  ring  area  - Oversize 

'd 

G 

cd 

P 

G 

O O 
G to 

&H  *r— 1 

G O 
’•>  G 

w ft 

S 3* 

O O 
« G 

a> 

Td 

co  g 
^ 0 

G rH 
G 

ft  cd 
O CO 

0 p 

-*-*  -H 

u B 
it;  <d 

Valve  seat  damage  when  removed 
per  PARR  0-5546311 

Insulator  has  two  cracks  along 
side  the  weld  bead 

Parts  damaged  beyond  use 

Motor  failed  after  4 hours  of 
operation 

REFERENCE  ONLY 

Insulation  scraped  from  wire 
exposing  bare  conductor 

REFERENCE  ONLY 

Upper  motor  assembly  noisy 

KRR  voided 

Voided;  No  W/F  required 

Flow  rate  not  to  specification 
Call  out  (CSM  0044) 

fd 

P 

G 

a> 

ON 

ip 

rH 

vD 

NA 

H 

P 

rH 

< 

0 

at 

p- 

CO 

Ut 

VO 

P 

80  ft 

LT\ 

H 

0 '0 

rH 

[— 

0 

1 — f 

p 

00 

p 

O 

cd  E 

PQ  vo 

O tP 

~i 

O oo 

1 

ft  O 

0 p 

CQ  VO 

P 1 — 1 

CQ  rH 

ft  a 

ft  0 

ft  O 

EH  G 

O 

oo 

p 

0 

0 

rH 

p 

O 

t — 1 

0 

O 

G 

O 

t— 

(P 

1 — 1 

ft 

O 

-H 

O 

0 

O 

0 

0 

LTN 

LfN 

tP 

G 

l rp 

1 K\ 

1 rH 

1 

t p 

1 P 

1 ON 

< 1 1 

t rP, 

1 fT\ 

1 *o» 

1 KO 

ft  1) 

C\J  1 

OJ  1 

CM  I 

CM 

CM  » 

CM  1 

CM  1 

CM  » 

CM  1 

a » 

CM  1 

a 1 

a 1 

CM  l 

G ft 

rp  tp 

p p- 

PP  <H 

P ON 

p LT\ 

P ON 

HA  VO 

KN  LT\ 

KN  LT\ 

KN  LTN 

ro,  H 

M'S  ft 

«J  § 

in  c\j 

IP  CO 

LTV  rH 

LT\  0 

P O 

P CM 

IP  CO 

Lf\  [>- 

LTN  O 

LTN  O 

fts  O 

LTN  O 

ft  h 

rp  l r\ 

fP  rH 

P O 

rp  ) — l 

P LTN 

P O 

P O 

KN  O 

ft\  LT  \ 

N~\  LfN 

KV  LTN 

fT\  LT  \ 

rp  uS. 

rp  ip 

G 

H rp 

rH  rp 

1 — 1 CM 

rH  P 

rH  -ft 

rH  -ft 

rH  CM 

rH  -H" 

H P- 

rH  -4 

j — 1 rH 

H H 

p a 

H rH 

>i 

t l 

>5 

ft 

r— 1 

B 

rH 

ft 

CD 

p 

B 

W 

P CD 

B 

1 — i 

CD 

<D 

CO 

G B 

O 

cd 

w 

G 

G 

cd 

G G 

G 

G 

cd  cd 

« 

0 

CO 

<D 

cd  S 

•H  O 

cd  S 

cd  a 

> 

>> 

ft  G 

CO 

•H  P 

cd 

ft 

ft  ft 

« 

cd  P 

ft  rH 

ft  rH 

H 

G cd 

G G 

ft 

ft 

G 

rH  Cd 

p 

p 

P 

p 

G p 

0) 

p 0 

H t — | 

CO 

G E 

O 

CD  1 — 1 

G E 

G B 

E 

E 

s 

ft  <L> 

CJ  ft 

CD  rH 

H • 

0 a> 

> P 

H co 

O G 

O (D 

0 a> 

P a> 

Cti  .O 

0>  ft 

£ <D 

£ > 

p co 

rH  Cd 

•H  G 

H w 

P w 

P co 

G co 

G co 

H G 

O ft 

0)  • 

0 CO 

cd  <D 

O 0 

O G 

0 w 

O co 

cd  co 

cd  to 

ft  ft 

W W 

LI  w 

ft  ft 

S cd 

> CO 

O ft 

ft  -H 

S cd 

S cd 

EH  cd 

EH  cd 

ft  cd 

ft  cd 

vo 

VO 

VO 

VO 

vo 

vo 

vo 

^O 

vo 

vo 

vo 

vo 

VD 

1> 

■'•X) 

VO 

'M3 

vD 

vO 

VO 

VO 

VO 

VO 

VO 

VO 

VO 

1 

t 

1 

l 

i 

1 

VD 

1 

VO 

1 

1 

j 

vo 

00 

oO 

cd 

CO 

00 

O 

rH 

1 

O 

1 

VD 

^0 

KV 

1 

CM 

Q 

rH 

CM 

CM 

rH 

1 — 1 

rH 

P 

H 

H 

a 

CJ 

1 

1 

IP 

•A 

rp 

LTN 

P 

■M3 

vo 

r— 

CO 

□0 

CO 

On 

0 

p 

CM 
1 — i 

C-68 


of  the  step-by-step  process,  three  assembly  examples  were  witnessed  within 
the  clean  room  areas.  Specifically,  the  installation  of  a lower  motor 
into  the  heater  tube  was  observed.  The  assembly  of  the  quantity  probe  to 
the  tank  tube  adapter  fitting  was  witnessed.  In  this  particular  case,  two 
attempts  were  required  to  properly  position  the  small  fill  tube  parts. 

The  entire  wire  routing  process  was  witnessed.  A tank  with  a large  hole 
in  the  side  provided  visibility  to  the  witnesses  but  not  to  the  assembly 
technicians.  The  installation  of  the  heater  fan  assembly  and  then  the 
quantity  probe  provided  an  appreciation  of  the  real  challenge  to  workmen, 
that  of  avoiding  damage  to  the  insulation  of  the  wires.  This  could  not 
have  been  learned  from  a study  of  the  drawings  alone. 

A 10-times-size  layout  was  made  of  the  fill  tube  connection  situation 
with  the  parts  at  the  various  limits  of  size  permitted  by  the  engineering 
drawings.  In  addition  to  the  length  tolerances  permitted  by  the  drawing 
dimensions,  the  diametral  clearance  also  permits  the  parts  to  assume  angles 
beyond  the  ranges  stated  on  the  drawings.  As  an  aid  to  check  all  the 
various  positions  to  which  these  parts  could  move,  individual  cutout  paper 
parts  were  made  for  the  two  Teflon  bushings  and  the  interconnecting  Inconel 
tube.  Figure  C4-49  shows  that  the  worst-case  short  tolerance  parts  can 
fall  out  of  position  as  the  tank  is  moved  about.  At  the  other  extreme, 
parts  that  are  at  the  high  end  of  the  permitted  tolerances  will  not 
assemble.  This  is  shown  on  the  left-hand  view.  The  nominal  case  provided 
little  or  no  axial  clearance  but  still  does  not  provide  gas-tight  seals  at 
the  various  diameters. 

In  addition  to  the  tolerance  condition  that  can  exist  for  the  fill 
tube  connecting  parts,  the  center  tube  of  the  quantity  probe  could  move 
downward  due  to  Teflon  cold  flow.  The  center  tube  is  supported  in  the 
axial  position  by  two  Teflon  bushings  installed  in  the  center  tube  and  a 
semi- tubular  rivet.  Prolonged  heating,  such  as  the  vacuum  pumpdown  cycles 
(three  cycles  for  this  tank  assembly  resulting  in  a total  of  1532  hours  at 
190  to  220°  F),  could  result  in  the  thin  walls  of  the  center  tube  slowly 
cutting  into  the  Teflon  bushings. 

Table  C4-II  shows  the  range  of  diametral  clearances  that  can  exist 
at  ambient  conditions  (73°  F)  and  at  a typical  detanking  condition 
(-278°  F,  which  corresponds  to  the  saturation  temperature  of  liquid  oxygen 
at  40  psia).  The  fit  between  the  Teflon  bushing  and  the  tank  adapter 
fitting  can  result  in  a maximum  0.003-inch  interference.  The  only  other 
clearance  that  results  in  an  interference  fit  occurs  if  the  minimum  size 
holes  are  provided  where  the  Teflon  bushings  slide  on  the  3/8-inch  Inconel 
tube.  Tests  at  liquid  nitrogen  temperature  (-320°  F)  indicate  that  the 
Teflon  is  not  overstressed  and  does  not  crack  when  subjected  to  inter- 
ference fits  of  this  type. 
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Figure  cU-l+9--  Extreme  and  nominal  tolerance  cases  for  fill  tube  connection  parts. 
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Throughout  the  normal  manufacture  and  test  of  a cryogenic  oxygen 
storage  tank,  no  intentional  procedure  calls  for  the  thermostats  to 
interrupt  a load.  The  acceptance  testing  by  the  thermostat  vendor  uses 
approximately  6.5  V ac  to  power  a small  lamp  bulb  which  draws  about  100 
milliamperes . The  fan  and  heater  assembly  component  acceptance  test  by 
Beech  uses  the  thermostats  to  complete  the  circuit  of  Wheatstone  bridges 
to  measure  the  heater  resistance  values.  All  other  testing  by  Beech 
applies  power  (65  V ac)  when  tank  conditions  are  such  that  the  thermostats 
should  be  closed  and  remain  closed,  or  momentarily  applies  a lower  power 
(30  t 10  V ac)  to  verify  that  thermostats  are  open. 


INTEGRATION,  SYSTEM  TESTING,  AND  PRELAUNCH 
CHECKOUT  OF  THE  CRYOGENIC  OXYGEN  STORAGE  TANKS 


Summary  of  Nominal  Processes  and  Procedures 

North  American  Rockwell,  Downey,  California.-  The  build-up  of  an 
oxygen  shelf  assembly  at  NR  begins*  many  weeks  before  insertion  of  the 
cryogenic  oxygen  tanks  with  the  fabrication  of  a pie-shaped  aluminum 
honeycomb  sandwich  structural  shelf  with  large  circular  cutouts  matching 
the  equatorial  girth  rings  of  the  spherical  tanks.  On  this  shelf  are 
next  mounted  the  valves,  pressure  transducers,  flowmeters,  and  tubing  to 
interconnect  these  with  the  fill  and  vent  panel  and  the  storage  tanks. 
Then  the  tanks  are  inserted,  no.  1 inboard  and  no.  2 in  the  outboard 
position  to  the  left  of  the  fill  panel  and  the  valve  module  (fig.  C4-50) . 
To  complete  the  shelf  assembly,  more  tubes  and  the  electrical  cabling 
are  added.  The  Beech  signal  conditioner  assembly  for  each  tank  is 
mounted  underneath  the  shelf. 

All  oxygen  system  tubing  joints  brazed  by  NR  are  subjected  to  X-ray 
inspection  and  reheated  if  necessary  to  achieve  satisfactory  joints. 

Pressure  and  leak  checks  are  conducted  as  are  electrical  checks  of 
tank  circuit  elements,  i.e.,  the  vac- ion  pump,  the  heater,  motor  fans, 
thermostats,  and  temperature  sensor  under  dry  gas  conditions  within  the 
oxygen  tanks.  The  thermostats  are  tested  for  both  opening  and  closing 
temperatures  by  use  of  nitrogen  gas  purge  with  variable  temperature  con- 
trol and  monitoring  each  thermostat  with  a digital  volt  meter.  Essen- 
tially no  current  is  interrupted  in  these  tests.  Such  tests  are  repeated 
in  accordance  with  detailed  Operational  Checkout  Procedures  (0CPTs)  un- 
til all  gas  leaks  or  electrical  wiring  problems  have  been  isolated  and 
corrected  and  the  oxygen  shelf  assembly  is  ready  for  installation  in  the 


*Use  of  the  present  tense  in  this  section  of  the  Panel  report 
implies  current  practices  as  of  1967-68. 
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Figure  c4-50.-  Oxygen  shelf  with  tanks  10024XTA0008 
and  10024XTA0009  installed. 
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service  module.  A proof  gas  pressure  of  1262  psi  is  used,  followed  by 
leak  testing  at  745  psi.  The  vac-ion  pumps  of  the  oxygen  storage  tank 
vacuum  jackets  are  turned  on  at  least  twice  during  typical  oxygen  shelf 
checkout  and  oxygen  system  checkout  at  NR.  These  tests  are  conducted 
with  an  NR  test  engineer,  manufacturing  test  conductor,  technicians,  and 
quality  control  personnel,  and  a NASA  quality  control  representative 
present.  No  cryogenic  oxygen  is  used  in  any  of  these  tests. 

After  the  oxygen  shelf  assembly  is  installed  in  the  service  module, 
various  gas  tubing  and  electrical  connections  are  completed.  The  oxygen 
tank,  tubing,  and  valves  thereafter  participate  in  oxygen  subsystem 
testing  of  the  service  module,  fuel  cell  simulator  tests,  and  fuel  cell 
interface  verification  in  accordance  with  Detail  Checkout  of  Systems 
(DCS's)  requirements.  Liquid  nitrogen  is  used  to  introduce  a cold  nitro- 
gen gas  into  the  oxygen  tank  to  cause  the  thermostats  to  close  so  that  a 
heater  circuit  continuity  test  can  be  conducted.  Spacecraft  bus  power 
(50  V dc)  is  applied  to  the  heater  circuits  and  an  increase  in  current 
is  used  to  verify  thermostat  closure.  After  water/glycol  system  test 
and  final  shelf  inspection,  cryogenic  oxygen  System  Summary  Acceptance 
is  accomplished  with  NASA/MSC  participation  and  recorded  in  the  System 
Summary  Acceptance  Document  ("SSAD  book" ) , 

The  discipline  at  NR,  Downey,  is  that  of  controlled  procedures  and 
hardware  traceability  from  the  controlled  material  and  equipment  stores 
through  assembly  and  test  operations.  This  discipline  produces  requests 
for  review  or  assistance  from  design  engineering  for  instances  of  quality 
or  test  discrepancy  considered  to  be  significant. 

Transportation  from  North  American  Rockwell  to  KSC.-  Shipment  of 
the  service  module  from  NR,  Downey,  is  made  on  a pallet  which  holds  the 
axis  horizontal  in  the  fore  and  aft  direction  of  trucks  and  aircraft 
(fig.  C4-51) . The  sector  in  which  the  oxygen  shelf  is  installed  is  on 
the  underside  in  this  orientation  so  that  the  shelf  centerline  points 
vertically  down.  Shock  and  vibration  instrumentation  of  various  service 
module  flights  in  the  Pregnant  Guppy  and  Super-Guppy  special  aircraft  of 
Aero  Spacelines  have  shown  no  peak  vibration  loads  exceeding  one-g  for 
vibration-isolated  movements  of  the  service  module. 

Kennedy  Space  Center.-  After  command  and  service  module  mating,  at 
the  Manned  Spacecraft  Operations  Building-KSC,  the  oxygen  shelf  assembly 
as  a part  of  the  service  module  participates  in  combined  system  test, 
altitude  chamber  test,  systems  integrated  test,  and  flight  readiness 
test  in  accordance  with  established  Test  and  Checkout  Procedures  (TCP’s), 
These  tests  are  conducted  as  dry  gas  pressure  and  electrical  function 
verifications  similar  to  those  of  the  factory  OCPTs  and  DCS's  at  Downey. 
No  specific  test  is  run  to  verify  thermostat  operation;  however,  during 
the  conduct  of  a pressure  switch  test  sequence,  the  thermostats  may  open 
the  28  V dc  heater  load. 


Aft  bulkhead  lifting  fixture 


Figure  CU-51.-  Pallet  holding  axis  horizontal  in  fore  and  aft 
direction  of  trucks  and  aircraft. 


The  vac-ion  pumps  of  the  oxygen  storage  tank  vacuum  jackets  are 
normally  turned  on  during  three  test  periods  at  KSC  including  countdown. 
The  circuit  breakers  to  the  vac-ion  pumps  are  opened  before  launch. 

After  integration  of  the  CSM  with  the  Saturn  launch  vehicle  in  the 
Vertical  Assembly  Building,  the  complete  vehicle  is  moved  to  Pad  39.  As 
a part  of  the  CDDT,  which  normally  occurs  l4  days  before  launch,  the  CSM 
storage  tanks  are  fully  loaded  with  liquid  oxygen.  The  functioning  of 
the  fans  is  checked  and  heater  operation  verified  by  using  a ground  sup- 
ply of  65  V dc  to  raise  the  tank  pressure  to  about  3 00  psi.  Shortly 
thereafter  it  is  necessary  to  partly  empty  the  oxygen  tanks  through  a 
process  known  as  "detanking."  Two  or  three  days  later,  at  the  conclu- 
sion of  the  CDDT,  detanking  is  again  used  to  empty  the  tank. 

Initial  detanking  consists  of  two  sequences.  First,  the  internal 
pressure  of  the  tank  (residual  to  the  CDDT)  is  vented  through  the  vent. 
Next,  warm  gaseous  oxygen  is  fed  through  the  tank  vent  lines  at  80  psia 
to  expel  liquid  through  the  fill  lines  down  to  30-percent  full.  Detank- 
ing for  tank  emptying  proceeds  similarly  at  the  end  of  CDDT.  Then  warm 
gas  is  blown  through  to  verify  that  the  thermostats  remain  closed  up  to 
at  least  -75°  F.  This  step  employs  the  application  of  only  10  to  15 
V dc  to  the  heater  circuit. 

This  loading,  checkout,  and  detanking  is  the  first  time  the  cryo- 
genic functions  of  the  oxygen  storage  tanks  are  evaluated  since  the 
acceptance  test  at  Beech  Aircraft,  Boulder,  Colorado. 

The  oxygen  tanks  are  filled  to  capacity  during  actual  countdown  in 
order  to  prepare  for  launch. 

During  the  CDDT  and  during  the  final  countdown,  as  long  as  the 
Mobile  Service  Structure  (MSS)  is  connected  to  the  Launch  Umbilical 
Tower  (LUT),  the  heaters  are  powered  from  the  ground  supply  system.  The 
power  distribution  station  from  where  the  heaters  are  powered  is  located 
at  the  base  of  the  LUT.  The  voltage  from  this  power  supply  is  automati- 
cally regulated  at  78  ± 2 V dc  and  recorded.  There  is  approximately 
13  volts  line  drop  along  the  connecting  leads,  resulting  in  about  63  V dc 
across  the  heaters,  producing  a current  of  about  6 amps  through  each 
heater  element.  This  higher  power  operation  is  used  to  more  rapidly 
raise  the  tank  pressure  to  the  operating  range. 

The  MSS  is  disconnected  from  the  LUT  at  about  18  hours  before  T - 0 
in  both  the  CDDT  and  the  final  countdown.  For  operational  reasons  the 
power  supply  to  the  heaters  is  switched  at  this  time  to  the  busses  of  the 
spacecraft  with  28  to  30  V dc  (about  2.8  amperes  through  each  heater 
element)  which  are  powered  through  the  umbilical  from  the  ground  supply 
system.  At  T - 4 hours,  during  the  launch  preparation,  the  busses  of  the 
spacecraft  are  switched  to  the  fuel  cells.  The  destratification  fans  are 
independent  from  the  heaters  and  at  all  times  powered  from  the  spacecraft. 


Summary  of  Significant  Aspects  of  Serial  No.  0008  Tank 
Prelaunch  Integration  Test  and  Checkout  History 

North  American  Rockwell,  Downey,  California. - Oxygen  storage  tank 
10024XTA0008  was  installed  in  the  no.  2 (outside)  position  of  oxygen 
shelf  S/N  06362AAG3277  at  North  American  Rockwell,  Downey,  California, 
soon  after  receipt  in  May  1967.  Two  disposition  reports  were  written 
during  October  1967  to  require  reheat  and  reinspection  of  brazed  tubing 
joints  on  the  oxygen  shelf  found  unacceptable  in  reading  of  X-rays.  These 
joints  were  reheated  and  accepted.  Completion  of  oxygen  tank  installa- 
tion, including  tank  10024XTA0009  in  the  no.  1 position,  was  accomplished 
March  11,  1968.  Manufacturing  and  test  flow  for  the  oxygen  shelf  is  dis- 
played chronologically  in  figure  C4-52. 

Two  disposition  reports  noting  an  "indentation"  and  a "ding"  in  the 
tank  outer  shell  were  filed  and  accepted--use  as  is--in  March  and 
April  1968. 

During  April  and  May  1968,  11  disposition  reports  were  written  to  log 
tank  no.  2 anomalies  found  during  pr oof -pres sure , leak-check,  and  func- 
tional checkout  of  the  assembled  oxygen  shelf.  Eight  of  these  were  as- 
cribed to  test  procedure  problems,  two  to  a valve  module  (check  valve) 
tubing  leak  and  one  to  an  electrical  connector  pin.  The  leak  was  rewelded 
by  a Parker  technician  and  passed  leak  test.  The  pin  was  repaired  by  NR 
and  checked. 

In  accordance  with  the  normal  OCP  and  after  leak  and  electrical  re- 
pairs, the  shelf  assembly  was  completed  and  tested.  It  was  installed  in 
CSM  106  June  4,  1968.  Thereafter,  in  compliance  with  several  DOS's  for 
subsystem  test,  a fuel  cell  simulator  test,  and  fuel  cell  interface 
verification,  the  oxygen  shelf  participated  in  service  module  detailed 
checkout  steps. 

After  installation  of  this  oxygen  shelf  in  SM  106,  eight  disposition 
reports  were  written  during  installation,  additional  tubing  connection 
and  subsystem  line  proof-pressure  and  leak  check,  and  electrical  cabling 
checking.  Of  these,  two  problems  with  a hydrogen  relief  line  mounted  ad- 
jacent to  the  oxygen  shelf  were  solved  by  making  up  new  tubing  and  later 
reheating  a brazed  joint  to  meet  X-ray  control  requirements.  Three  oxygen 
subsystem  leaks  were  solved  by  retorquing  caps  and  a "B"  nut  on  oxygen 
lines  leading  to  fuel  cell  no.  2.  The  three  remaining  disposition  records 
expressed  questions  concerning  leak  and  electrical  function  testing  of  the 
oxygen  shelf  assembly  which  were  held  open  pending  the  next  opportunity 
for  shelf  assembly  testing. 

On  October  21,  1968,  in  response  to  directives  requiring  rework  of 
the  vac-ion  pump  dc-to-dc  converters  to  reduce  electromagnetic 
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Figure  cU-52.-  Manufacturing  and  test  flow  for  the  oxygen  shelf 


interference  problems  (a  supplementary  potting  operation  performed  by 
Beech  personnel  at  North  American  Rockwell),  an  attempt  was  made  to  re- 
move the  oxygen  shelf  from  SM  106. 

In  preparation  for  this  attempt,  the  10  bolts  attaching  the  shelf  to 
the  adjacent  beams  were  removed.  The  existence  of  a small,  11th  bolt  in- 
troduced from  underneath  and  behind  tank  no.  1 was  overlooked  by  all 
persons  involved.  The  factory  crew  brought  into  position  a lifting  fixture 
particularly  devised  for  inserting  tanks  and  shelves  into  sectors  of  the 
service  module  (fig.  C4-53)* 

This  fixture  is  composed  of  two  parts  joined  at  a bolted  flange.  The 
universal  part  is  an  adjustable  counterbalance.  The  weights  of  this 
counterbalance  are  movable  from  the  factory  floor  through  endless  chains. 

The  particular  part  for  handling  to  the  oxygen  shelf  is  a two-tined  fork 
welded  together  from  large  thick-walled  aluminum  tubes.  The  tine  tips 
are  padded  where  they  contact  the  underside  of  the  shelf  to  support  its 
inner  portion.  'The  outer  edge  of  the  shelf  is  fastened  to  the  lifting 
fork  by  means  of  two  screws  passing  through  tabs  on  the  top  of  the  fork 
cross -member . 

Under  the  particular  circumstances  of  October  21,  1968,  the  unnoticed 
11th  bolt  into  the  shelf  served  as  a tie-down  beyond  the  tips  of  the  lifting 
fork  such  that  raising  the  fixture  produced  rotation  of  the  entire  assembly, 
most  noticeably  the  counterbalance.  The  11th  bolt  still  was  unobserved. 
Attempts  were  made  to  balance  the  fixture  by  moving  a weight  and  to  lift  the 
assembly  by  operating  the  overhead  bridge  crane.  In  these  steps  sufficient 
load  was  placed  on  the  fixture  to  break  it  above  the  cross-arm  of  the  fork. 

The  oxygen  shelf  moved  and  came  to  rest  on  the  supporting  beams 
through  what  was  at  the  time  described  as  a "2-inch  drop".  Observation  of 
adjacent  portions  of  SM  106  identified  minor  damage,  including  a dent  in 
the  underside  of  the  fuel  cell  shelf  above. 

Figure  C4-54  shows  the  repair  patch  over  this  dent  immediately  above 
the  vacuum  pinch-off  cover  can  of  tank  no.  2 in  the  oxygen  shelf  that  re- 
placed the  one  undergoing  the  "shelf  drop"  incident  in  SM  106. 

Further  attention  to  the  oxygen  shelf  containing  tank  10024XTA0008 
in  the  no.  2 position  after  its  removal  from  SM  106  involved  a number  of 
quality,  test,  and  repair  actions.  These  were  logged  on  11  separate  Dis- 
position Records  (NR  numbered  forms  recording  discrepancies  observed 
through  manufacturing  inspection  and  test  activities  at  Downey).  One 
other  such  form  was  initiated  at  the  time  of  the  "shelf  drop"  and  was 
treated  primarily  as  a requirement  to  inspect,  repair,  and  re-inspect  the 
adjacent  portions  of  SM  106,  including  specifically  the  dented  fuel  cell 
shelf. 
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Figure  CU-53.-  SM  bay  k tank  installation. 


Figure  C4-54.-  Replacement  oxygen  shelf  installed  in 
Service  Module  106.  Note  repairs  to  fuel  cell 
snelf  over  oxygen  tank  no.  2. 
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Of  the  11  DR's,  five  report  anomalous  conditions  of  detailed  portions 
of  the  shelf  assembly  observed  and  recorded  from  November  1 to  November  19, 
1968.  In  response  to  these  DR's,  EMI  tests  and  leakage  tests  were  con- 
ducted, results  were  accepted,  and  some  repairs  were  made.  The  leak  tests 
of  bent  tubing  carrying  tank  no.  1 pressure,  upstream  from  valves,  were 
accepted  in  material  review.  The  latter  involved  polishing  out  tank  outer 
shell  scratches,  adjusting  several  electrical  connectors,  replacing 
damaged  cable  clamps,  and  coating  damaged  potting.  It  is  not  certain  but 
it  is  possible  that  some  of  these  conditions  relate  to  the  ,Tshelf  drop" 
incident . 

The  remainder  of  the  DR's  of  the  period  relate  to  testing  the  oxygen 
shelf  to  revalidate  it  for  installation  into  SM  109.  A shortened  version 
of  the  normal  pre-installation  OOP,  including  pressure  and  external  leak 
testing  and  verification  of  electrical  functions  of  most  of  the  tank 
elements,  was  conducted.  Fan  motor,  heater,  fuel  cell  reactant  valve, 
relief  valve,  pressure  switch,  and  motor  switch  functional  checks  were 
omitted.  Coupling  leak  checks  and  check  valve  internal  leak  valve  checks 
were  omitted.  Signal  conditioner  checks,  for  density  and  temperature  sig- 
nals, were  omitted.  Verification  of  these  matters  was  left  for  and  accom- 
plished in  oxygen  system  tests  at  higher  levels  of  CM  and  SM  integration. 
The  shelf  was  then  installed  (fig.  C4-55).  The  upper  one  of  the  two 
accepted  bent  tubes  shows  at  the  extreme  right  of  the  figure.  The  lower 
one,  bent  7 degrees  as  it  joins  the  back  of  the  fuel  cell  valve -module , 
is  in  the  lower  right  corner. 

In  December  1968,  after  concern  for  a possible  oil  contamination  of 
facility  lines,  GSE  hose  connections  were  checked  for  contamination  and 
found  acceptable.  Vent  line  samples  taken  later,  at  KSC  during  cryogenic 
tanking,  verified  that  no  contaminants  reached  the  spacecraft  interfaces. 

Engineering  requests  for  recalibration  of  the  oxygen  system  pressure 
instrumentation  and  the  oxygen  quantity  signal  conditioner  of  the  assembly 
were  responded  to  in  January  and  February,  1969- 

Final  inspection  and  cleanup  of  the  shelf  in  the  service  module  was 
accomplished  on  May  27,  1969-  The  oxygen  SSAD  book  was  signed  off  June  6, 
1969?  and  SM  109  was  shipped  to  KSC. 

Transportation  from  North  American  Rockwell  to  KSC.-  Shipment  of 
SM  109  from  Downey  to  KSC  was  accomplished  by  the  normal  means,  horizontal 
mounting  on  a vibration  isolating  pallet  carried  on  ground  vehicles  and  a 
Super-Guppy  aircraft.  No  shock  was  observed  in  the  instruments  carried. 

Kennedy  Space  Center.-  The  oxygen  tank  and  shelf  assembly  participated 
in  normal  service  module  tests  beginning  with  the  Combined  Systems  Test. 
Test  and  checkout  flow  at  KSC  are  shown  chronologically  in  figure  C4-56. 
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gure  C4-^5.-  Oxygen  shelf  installed  in  service  module 
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Figure  CU-56.-  Test  flow  for  oxygen  shelf  at  KSC 


A leak  check  was  performed  July  18,  1969 , using  helium  at  9^  psia 
in  oxygen  tank  no.  2.  Tank  no.  2 was  pressurized  to  1025  psia  to  estab- 
lish the  relief  valve  cracking  pressure  and  to  verify  the  pressure  switch 
operation.  The  pressure  was  decreased  to  870  psia  and  then  increased  to 
95^  psia  during  the  first  integrated  test  with  the  launch  vehicle  simu- 
lator. The  oxygen  tanks  no.  1 and  no.  2 were  evacuated  to  less  than  5mm 
Hg,  to  dry  the  tanks,  then  pressurized  to  about  80  psia  with  reactant 
grade  gaseous  oxygen.  Instrumentation  was  verified  and  fan  motors  were 
checked  out. 

A progress  photograph  (fig.  CU-57)  taken  at  KSC  on  November  Ik , 1969* 
shows  the  visible  condition  of  the  oxygen  shelf  with  tanks,  valves,  tubing, 
and  cables. 

During  the  Flight  Readiness  Test  in  early  February  1970,  the  pres- 
surization cycle  was  repeated;  vacuum  to  5mm  Hg  and  oxygen  pressure  to 
about  80  psia. 

At  the  CDDT  in  March  after  activation  of  the  fuel  cells,  the  same 
cycle  was  followed:  vacuum  of  the  oxygen  tanks  to  5mm  Hg  followed  by  a 

gaseous  oxygen  pressure  of  about  80  psi.  After  the  cooling  of  the  fuel 
cells,  cryogenic  oxygen  loading  was  normal  and  tank  pressurization  to 
331  psia  by  using  heaters  powered  from  65  V dc  ground  power  supply  was 
completed  without  abnormalities. 

During  these  CDDT  operations  on  March  23,  tank  no.  1 was  detanked  to 
the  normal  50  percent  within  less  than  10  minutes.  Over  the  space  of 
U5  minutes,  tank  no.  2 did  not  detank  normally  but  was  observed  to  retain 
more  than  90  percent  of  its  oxygen.  Detanking  was  suspended  until  the 
completion  of  CDDT. 

On  March  27,  detanking  of  tank  no.  2 was  again  attempted.  The  tank 
had  self-pressurized  to  178  psia  with  a quantity  of  83  percent  indicated. 

By  opening  the  fill  line  valve  the  pressure  was  depleted  to  approximately 
36  psia  in  about  13  minutes.  The  quantity  indication  went  down  to  about 
65  percent  (see  fig.  CU-58). 

Next,  during  detanking  attempts  for  both  tanks,  a comparison  of 
tank  no.  1 and  tank  no.  2 performance  was  made.  The  indicated  oxygen 
quantity  of  tank  no.  1 depleted  from  U8  percent  to  zero  in  less  than 
10  minutes.  The  indicated  quantity  in  tank  no.  2 remained  above  60  percent 
over  a 20-minute  period. 

Attempts  were  made  over  an  80-minute  period  to  deplete  the  oxygen 
content  of  tank  no.  2 by  cycling  up  to  various  pressures  and  down,  but 
did  not  reduce  the  indicated  quantity  below  5^  percent  (fig.  CU— 59 ) - An 
attempt  was  made  to  expedite  oxygen  expulsion  through  the  use  of  the  tank 
heaters  operated  at  maximum  voltage  and  the  fans.  These  were  turned  on 
for  nearly  6 hours  while  the  vent  port  remained  open  (fig.  CU-60).  Still 
the  indicated  quantity  remained  above  30  percent. 
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Figure  CU-57--  Progress  photograph  of  oxygen  shelf  taken  at  KSC 

November  l4,  1969 


Pressure,  psia  Temperature,  F Quantity,  percent 


Time,  e.s.t. , March  27,  1970 


Figure  cU— 58. — Oxygen  tank  2 detanking  characteristics  (pressure 
decay  through  the  fill  line  - CDDT ) . 
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Figure  CU-59--  Oxygen  detankipg  attempt  using 
varying  purge  pressure. 
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Then  a pressure  cycling  technique  was  employed  over  a 2-l/2  hour 
period  with  maximum  power  being  applied  continuously  to  both  tank 
heaters  and  fan  circuits  (fig.  c4-6l) . This  technique  involved  raising 
the  tank  pressure  by  external  gaseous  oxygen  to  approximately  300  psia 
and  then  opening  the  fill  line  to  induce  rapid  boil-off.  After  five 
cycles,  the  oxygen  tank  quantity  indicated  zero. 

Fan  responses  were  observed  to  be  normal  throughout  these  opera- 
tions. The  temperature  sensor  on  the  quantity  probe  reached  its  indi- 
cating limit  (+84  F)  halfway  through  the  6-hour  heating  period.  No 
observations  of  whether  the  heaters  cycled  on  and  off  were  made  and 
subsequent  review  of  the  power  supply  voltage  recording  showed  no  indi- 
cation of  heater  cycling. 

Concern  developed  over  two  alternate  hypothetical  tank  no.  2 con- 
ditions, a leakage  path  in  the  fill  line  within  the  tank  or  a clogged 
fill  line. 

Gaseous  flow  tests  were  used  in  one  attempt  to  evaluate  the  latter. 
Both  tank  no.  1 and  tank  no.  2 were  pressurized  to  approximately  240 
psia  and  blown  down  through  the  fill  lines  with  no  significant  differ- 
ences in  blowdown  time  (fig.  C4- 62) . 

A check  of  the  Wintec  filter  in  the  GSE  for  oxygen  tank  no.  2 was 
made  by  the  Wintec  Corporation.  No  significant  foreign  material  was 
found . 

The  alternate  hypothesis,  that  the  short  segments  of  fill  tube  in 
the  top  of  the  quantity  probe  of  tank  no.  2 had  large  gaps  or  had  be- 
come dislodged,  was  considered  as  were  the  operational  difficulties 
associated  with  the  use  of  a tank  in  this  condition.  The  concern  here 
was  that  the  loading  process  might  be  hampered  by  the  position  of  the 
fill  line  parts.  It  was  noted  that  the  filling  was  normal  for  the  CDDT. 

To  verify  this  judgment  and  to  assure  countdown  operability,  both 
tanks  were  filled  on  March  30  to  about  20  percent  in  approximately  2.5 
minutes.  Tank  no.  1 detanked  normally;  tank  no.  2 did  not.  Again  the 
procedure  of  applying  heat  at  maximum  voltage  and  the  cyclic  application 
of  gas  pressure  of  approximately  250  psia  and  then  venting  was  used. 

Five  cycles  were  applied  in  a 1-1/4  hour  period  and  tank  no.  2 was 
emptied  (fig.  C4-63).  The  fan  responses  were  observed  to  be  normal  and 
no  indications  of  heater  cycling  were  observed. 

During  the  countdown,  April  8,  1970,  the  pressurization  of  oxygen 
tank  no.  2 was  hampered  by  a leak  through  the  vent  line  pressure-operated 
disconnect.  Installation  of  the  first  cap  stopped  the  leak  and  the 
pressurization  of  tank  no.  2 was  normal  with  no  anomalies  noticed  during 
the  completion  of  the  countdown. 
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Figure  c4-6l.-  Oxygen  detanking  using  pressure 
cycles  and  tank  heaters. 
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Figure  Cb-62.-  Gaseous  oxygen  'blowdown  test,  spacecraft  109. 


1600  1630  1700  1730  1800 


Time,  e.s.t.,  March  30,  1970 


Figure  Ck-6 3.-  Oxygen  detanking  using  pressure 
cycles  and  tank  heaters. 


Several  items  of  overall  tank  test  and  checkout  experience  should  be 
noted. 

Contaminants:  Liquid,  as  well  as  gaseous,  oxygen  which  entered  tank 

no.  2 was  verified  by  sample  analysis.  Nothing  indicates  that  contaminants 
did  enter  the  oxygen  tanks.  The  samples  taken  from  the  vents  during  the 
servicing  met  the  specification  requirements  and  did  not  give  an  indication 
of  tank  contamination. 

Quantity  probe:  Throughout  all  tests,  during  a period  of  11  months 

resulting  in  167  hours  8 minutes  operating  time  including  28  fan  on/off 
cycles  over  the  17-day  period  of  CDDT  and  launch  count,  the  quantity  gaging 
system  in  tank  no.  2 exhibited  less  sensitivity  to  noise  and  transients 
than  that  of  tank  no.  1. 

Oxygen  tank  no.  2 pressure  cycling:  At  no  time  during  the  testing 

of  oxygen  tank  no.  2,  in  systems  and  subsystems,  were  the  specified 
pressure  limitations  or  allowable  tank  cycles  exceeded. 

Testing  of  oxygen  tank  fans:  Test  records  were  reviewed  of  all  fan 

motor  operations  at  KSC  for  any  indications  of  ac  bus  transients.  Tank 
no.  2 fans  were  powered  30  times.  No  electrical  transients  were  found 
except  those  normally  connected  with  fan  starting  or  stopping.  Fan  motor 
performance  was  considered  normal. 


Investigation  and  Supporting  Work 

Causes  of  detanking  difficulties.-  Review  of  information  from  the 
Beech  acceptance  test  logs  and  review  with  the  Beech  personnel  in  charge 
of  these  tests  does  not  indicate  that  the  detanking  was  abnormal.  Con- 
trarywise,  the  data  are  not  substantive  to  prove  that  the  liquid  was 
expelled  through  the  fill  line.  No  weight  or  quantity  measurement  is 
recorded  at  the  completion  of  the  liquid  expulsion;  however,  the  proce- 
dure calls  for  continuing  the  application  of  vent  line  pressure  until 
both  the  weighing  system  and  the  quantity  probe  indicate  the  tank  is 
empty.  The  final  tank  empty  condition  is  based  on  the  final  exit  tem- 
perature of  the  warm  nitrogen  gas  purge.  At  the  time,  no  one  indicated 
that  the  response  of  the  tank  to  the  procedures  was  anything  but  normal, 
and  today  careful  review  of  existing  data,  discussions  with  the  responsi- 
ble Beech  Aircraft  and  North  American  Rockwell  personnel,  and  a special 
test  at  Beech  Aircraft  indicate  that  the  detanking  of  the  0008  tank  was 
most  probably  normal. 

Each  oxygen  storage  tank  is  stored  at  NR,  Downey,  in  its  shipping 
container  until  removal  for  installation  in  the  assigned  oxygen  shelf. 
Thus  it  is  retained  in  a vertical  position  until  any  motion  takes  place 
in  the  shelf  assembly  fixture. 


The  shelf  assembly  fixture  used  at  Downey  (fig.  C4-50)  aligns  tank 
no.  1 so  that  the  fill  tube  segments  in  the  top  of  the  quantity  probe 
assembly  lie  nominally  in  a plane  transverse  to  the  axis  of  fixture  rota- 
tion. Thus  the  fixture  in  the  normal  position  holds  the  tubes  upright 
but  otherwise  can  rotate  them  through  a full  circle , exposing  them  to 
dislodging  forces  in  the  plane  of  their  nominal  location.  The  situation 
for  tank  no.  2 is  nearly  a right  angle  to  the  tank  no.  1 situation  so 
that  the  tube  segment  plane  is  nominally  parallel  to  the  trunnion  axis  of 
the  assembly  fixture.  Thus  in  all  positions  other  than  vertical  or  in- 
verted, a lateral  dislodging  force  exists  relative  to  the  plane  of  their 
nominal  location. 

The  highest  elevation  of  the  tank  assembly,  and  thus  the  first  area 
of  contact  with  the  underside  of  the  fuel  cell  shelf  at  the  time  of  the 
lifting  fixture  breakage  and  the  shelf  dent,  was  the  cover  over  the  upper 
vacuum  pinch-off  tube  (fig.  04-55)-  This  point  was  to  the  left  of  the 
mass  centers  and  lifting  forces  involved  as  the  counterbalance  rotated 
and  broke  away  from  the  fork  portion  of  the  lifting  fixture.  (See 
Appendix  D. ) Some  rotation  to  lift  the  outer  right  corner  of  the  shelf 
(lower  right  in  fig.  04-55)  higher  than  the  outer  left  would  be  expected 
from  this  configuration.  An  uneven  fall  to  the  shelf  supports  would 
follow. 

In  figure  04-55?  showing  the  installation  of  the  oxygen  shelf  in 
SM  109,  the  condition  of  the  farthest  right  tubing  in  the  lower  part  of 
the  picture  reflects  the  comments  of  two  DR’s  that  one  tube  had  a "slight 
bend"  at  the  valve  module  and  another  (lower)  was  "badly  bent."  As  the 
highest  tubes,  farthest  from  the  11th  bolt  and  the  high  point  of  tank 
no.  2,  these  two  may  have  participated  in  the  "shelf  drop"  incident. 

Neither  was  found  to  be  in  need  of  repair  after  leak  check. 

No  mention  could  be  found  in  review  of  these  DR's  of  any  concern  for 
the  condition  of  the  tubes,  wires,  or  motors  internal  to  the  oxygen  storage 
tank  except  as  verifiable  through  routine  external  gas  and  electrical 
testing  with  NR  factory  OOP's. 

Shipment  of  SM  109  from  NR/Downey,  with  the  SM  axis  horizontal  during 
ground  and  air  transporation,  afforded  the  next  major  opportunity  for 
fill  tube  segment  lateral  dislodgment. 

It  appears  pertinent  to  this  review  to  note  that  during  SM  transpor- 
tation the  fill  tube  segments  within  the  upper  portion  of  the  oxygen  tank 
no.  2 quantity  probe  assembly  lay  with  the  tank-exit  end  of  the  fill  tube 
segments  about  20  degrees  above  the  horizontal,  if  they  were  still  in 
place  after  previous  handling  and  the  "shelf  drop. " Neither  the  wires 
nor  the  feed  line  filter  were  below  it  to  restrict  rotation  of  the  fill 
tube  about  the  central  tube  of  the  quantity  probe  (fig.  C4-64). 
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Figure  CU-6U.-  Isometric  sketch  of  quantity  probe  head  as  oriented 

during  SM  transportation. 


This  history  of  exposure  of  the  tank  fill  tube  segments  to  an  un- 
usual dislodgment  environment  sequence  was  not  recorded  during  the  de- 
tanking incidents  at  KSC  nor  during  the  presentation  of  CSM  109  history 
reviews  to  the  Apollo  Spacecraft  Program  Manager  through  either  reliabil- 
ity and  quality  assurance  or  engineering  channels  at  MSC . However,  it 
does  corroborate  the  recorded  real-time  judgment  of  Beech,  MSC,  and  KSC 
engineers  that  the  tank  fill  line  parts  may  have  been  out  of  place  in 
tank  10024XTA0008  during  the  detanking  problems  of  March  23-30,  1970, 

Since  the  fill  tube  parts  have  dimensional  tolerances  that  could 
allow  these  parts  to  fall  out  of  place,  a calculation  was  made  to  attempt 
to  establish  the  configuration  of  the  tank  during  the  detanking  operations 
at  KSC.  The  data  from  the  first  detanking  attempt  of  March  27  were  used 
to  test  the  hypothesis  that  the  fill  tube  parts  were  disconnected  such 
that  no  liquid  was  expelled  from  the  tank.  A simple  heat  balance  equation 
of  the  tank  from  the  initial  condition  to  the  end  condition  shows  that  all 
the  mass  lost  by  the  tank  can  be  explained  by  vaporization  and  it  is  like- 
ly that  no  liquid  was  expelled.  Figure  C4-58  and  table  C4-III  show  the 
data  upon  which  these  calculations  were  based.  At  the  initial  and  final 
point  the  temperature  indicated  in  the  data  is  too  warm  for  the  pressure 
indicated.  The  saturation  temperature  was  used  for  each  case. 

Possible  effects  of  special  detanking  procedures  at  KSC.-  The  use  of 
special  detanking  procedures  at  KSC  to  empty  tank  no.  2 of  CSM  109  has 
created  concern  these  special  procedures  may  have  altered  significantly 
the  condition  of  the  oxygen  tank. 

A number  of  special  tests  have  been  run  and  other  tests  are  yet  to 
be  run  in  an  attempt  to  determine  the  nature  and  degree  of  degradation 
that  may  be  expected  to  occur  to  the  tank  internal  components  and  wiring 
resulting  from  exposure  of  this  type.  The  most  significant  finding  to 
date  is  the  fact  that  the  thermostats  fail  by  welding  closed  almost  im- 
mediately when  attempting  to  interrupt  65  V dc. 

Several  tests  were  run  to  determine  the  temperature  that  would  occur 
at  various  points  on  the  heater  tube  as  a result  of  operation  at  ground 
power  level  as  the  liquid  in  the  tank  is  boiled  off.  These  tests  were 
run  at  MSC  using  a similar  sized  tank  with  an  actual  flight-type  heater 
fan  assembly.  The  test  setup  is  shown  on  figure  C4-65.  Liquid  nitrogen 
was  used  in  the  tank  for  safety  reasons.  The  initial  run  was  made  with 
a later  model  heater  fan  assembly  that  does  not  utilize  thermostats; 
however,  it  was  felt  that  as  long  as  liquid  nitrogen  was  present  it  was 
not  likely  that  the  thermostats  would  be  called  upon  to  operate.  During 
this  test  very  high  temperatures  were  encountered  on  many  locations  on 
the  heater  tube  (figure  C4-66) . These  conditions  were  considered  to  be 
very  unrealistic,  so  the  test  was  rerun  using  a heater  fan  assembly 
equipped  with  thermostats.  When  the  test  was  started,  one  thermostat 
indicated  an  open  circuit  at  the  initial  fill  condition.  It  was  decided 
that  a satisfactory  test  could  be  run  since  an  extra  lead  had  been  ex- 
tended from  the  heater  elements  so  that  the  heaters  could  be  manually 
operated  to  coincide  with  the  functioning  of  the  operable  thermostat. 
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TABLE  C4-III. - THERMODYNAMIC  BALANCE  CALCULATIONS 


Initial  condition 

Final  condition 

Quantity,  lb 

274  (83$  indie.) 

212  (65$  indie.) 

Pressure,  psia 

178 

36 

Temperature,  ° F 
Temperature,  0 R 

-236.5 

223.2 

-280 

179-7 

Density  of  liquid,  lb/ft^ 

58.4 

68.0 

Volume  of  liquid,  ft^ 

4.70 

5.10 

Volume  of  gas , f t^ 

.05 

1.65 

Weight  of  liquid,  lb 

273.85 

210.9 

Weight  of  gas,  lb 

0.15 

1.1 

Enthalpy  of  liquid, 
Btu/lb 

88 

68 

Enthalpy  of  gas,  Btu/lb 

158 

155 

Total  enthalpy  of 
liquid,  Btu 
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Figure  C-U.65.-  Heater  tube  assembly  temperature  test  setup. 
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(a)  Temperature  sensor  locations. 

Figure  C4-66.-  Heater  tube  assembly  temperature  test. 
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The  test  was  started  and  after  a few  cycles  in  this  mode  the  previously 
nonfunctioning  (open)  thermostat  started  indicating  normal  function.  At 
this  time  it  was  decided  to  revert  to  the  originally  intended  test  config- 
uration, i.e.,  the  thermostats  directly  controlling  the  heaters.  Data 
from  that  point  on  indicated  that  the  thermostats  were  not  cycling  the 
heaters.  The  heater  tube  temperature  data  looked  just  like  the  nonther- 
mostat test  run.  The  test  terminated  at  this  point  and  the  thermostats 
were  removed  and  X-rayed.  The  X-rays  indicated  that  the  contact  gap  was 
bridged.  One  thermostat  had  its  case  carefully  removed  to  examine  the 
conditions  of  the  contacts  (fig.  CU-67). 

A review  of  the  thermostat  design  and  the  manufacturer’s  ratings 
indicate  that  the  thermostats  are  severely  overloaded  in  current- 
interrupting capability  at  the  ground  power  condition.  Open  contact 
spacing  at  65  V dc  is  such  that  a sustained  arc  can  be  established  and 
the  contacts  melted  at  this  first  attempt  to  interrupt  power  of  this 
magnitude. 

Inasmuch  as  thermostat  failure  would  be  expected  at  the  first  attempt 
to  interrupt  the  ground  power  level,  the  conditions  of  heater  tube  temper- 
ature measured  during  the  first  test  of  this  series  would  be  indicative 
of  those  experienced  during  the  KSC  special  detankings  of  March  27,  28, 
and  30.  Since  a review  of  the  heater  ground  power  supply  voltage  re- 
cordings made  during  the  special  detanking  operations  showed  no  indica- 
tion of  heater  cycling,  a special  postflight  test  was  conducted  at  KSC 
which  showed  that  the  cycled  load  equivalent  to  the  heaters  would  cause 
a cycling  in  the  voltage  recording.  Figure  CU-68  shows  sections  of  motor 
lead  wire  removed  from  the  heater  tube  conduit. 

Other  tests  run  at  Ames  Research  Center  (see  Appendix  F)  indicate 
that  Teflon-insulated  wires  run  at  similar  temperatures  in  an  oxygen 
atmosphere  result  in  even  more  severe  degradation. 

A test  is  being  run  at  Beech  Aircraft  to  simulate  all  the  tanking 
and  detanking  conducted  on  XTA-0008  at  KSC.  A Block  I tank  modified  to 
the  Block  II  configuration  with  the  fill  tube  connecting  parts  rotated 
out  of  position  is  being  used  for  this  test.  Temperature  measurements 
on  the  electrical  conduit  in  the  vacuum  dome  area  and  posttest  inspection 
will  be  utilized  to  evaluate  the  effects  on  the  wiring  of  the  special 
detanking  operations. 

At  no  time  during  standard  checkout,  prelaunch,  and  launch  opera- 
tions are  these  thermostats  required  to  interrupt  the  65  V dc  ground 
power  supply  current.  As  far  as  could  be  determined,  the  special  de- 
tanking operation  was  the  only  time  that  any  thermostats  were  ever 
called  upon  to  interrupt  this  load. 
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(b)  Welded  contacts  after  test. 


Figure  C4-67.-  Thermostat  configuration  and  welded  contacts. 
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TASK  ASSIGNMENT 


The  Design  Panel  was  assigned  the  task  of  reviewing  the  design  of 
the  systems  involved  in  the  Apollo  13  accident,  including  their  qualifi- 
cation history.  The  service  history  of  the  specific  components  flown 
on  Apollo  13  was  also  to  be  examined  from  a design  point  of  view  to  as- 
certain whether  any  abnormal  usage  experienced  might  have  had  a detri- 
mental effect  on  the  functional  integrity  of  the  components.  The  Panel 
was  also  charged  with  review  of  other  spacecraft  systems  of  similar  de- 
sign or  function  to  ascertain  whether  they  contained  potential  hazards. 
Finally,  the  Panel  was  to  analyze,  as  required  by  the  Board,  proposed 
failure  mechanisms  to  the  extent  necessary  to  support  the  theory  of 
failure . 

The  Panel  conducted  its  activities  by  reviewing  design  documentation 
and  drawings,  historical  records,  and  test  reports;  analyzing  data;  ex- 
amining specimens  of  hardware;  and  consulting  with  other  Board  Panels 
and  with  members  of  the  Manned  Spacecraft  Center  (MSC)  Investigation  Team 
and  the  contractors. 
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PART  D2 


PANEL  ORGANIZATION 


Panel  3 was  chaired  by  Dr.  S.  C.  Himmel,  Lewis  Research  Center,  and 
the  Board  Monitor  was  Mr.  V.  L.  Johnson,  Office  of  Space  Science  and 
Applications,  NASA  Headquarters.  Panels  Members  were: 

Mr.  W.  F.  Brown,  Jr. 

Lewis  Research  Center 

Mr.  R.  N.  Lindley 

Office  of  Manned  Space  Flight 

NASA  Headquarters 

Dr.  W.  R.  Lucas 

Marshall  Space  Flight  Center 

Mr.  J.  F.  Saunders,  Jr. 

Office  of  Manned  Space  Flight 

NASA  Headquarters 

Mr.  R.  C.  Wells 

Langley  Research  Center 

Specific  assignments  covering  such  areas  as  materials  selection, 
fracture  mechanics,  materials  compatibility,  failure  mechanisms,  related 
systems,  and  electrical  systems  were  given  to  each  Panel  Member.  All 
Panel  Members  participated  in  the  preparation  of  this  report. 
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PART  D3 


REVIEW  AMD  ANALYSIS 


Early  in  ihe  proceedings  of  the  Board,  it  Became  evident  that  the 
failure  was  centered  in  the  cryogenic  oxygen  subsystem  of  the  electrical 
power  system  of  the  spacecraft,  and,  more  specifically,  in  the  no.  2 
cryogenic  oxygen  tank.  For  this  reason,  detailed  examinations  of  the 
Panel  were  limited  to  this  subsystem.  Interfacing  systems  were  examined 
only  to  the  extent  required  to  understand  the  function  of  the  oxygen 
system  and/or  to  relate  data  from  flight  or  test  to  the  operation  or 
design  of  the  system. 

In  addition,  the  Panel  had  one  of  its  members  present  at  the 
deliberations  of  the  MSC  Panel  on  Related  Systems  which  conducted  reviews 
on  other  Apollo  spacecraft  pressurized  systems. 


SYSTEM  DESCRIPTION 


The  cryogenic  storage  subsystem  supplies  reactants  to  the  fuel  cells 
that  provide  electric  power  for  the  spacecraft.  The  oxygen  system  also 
supplies  metabolic  oxygen  for  the  crew,  command  module  (CM)  cabin  pressur- 
ization, and  the  initial  pressurization  of  the  lunar  module  (LM).  The 
cryogenic  storage  and  fuel  cell  subsystems  are  located  in  bay  h of  the 
service  module  (SM).  Figure  D3-1  shows  the  geometric  arrangement . of 
these  subsystems  within  this  portion  of  the  SM.  The  system  comprises 
two  oxygen  tanks,  two  hydrogen  tanks,  and  three  fuel  cells  with  their 
associated  plumbing,  control  valves,  regulators,  pressure  switches,  and 
instrument ati on . 

The  uppermost  shelf  contains  the  three  fuel  cells;  the  center  shelf 
contains  the  two  oxygen  tanks,  the  oxygen  system  valve  modules,  the  fuel 
cell  oxygen  valve  module,  and  a ground  service  interface  panel.  The 
lower  shelf  contains  the  two  hydrogen  tanks,  one  above  and  one  below  the 
shelf,  and  a set  of  valve  modules  analagous  in  function  to  those  of  the 
oxygen  system. 

A description  of  these  components  is  contained  in  Appendix  A of  the 
Board’s  report.  Also  provided  are  the  operating  and  design  parameters  of 
the  components,  materials  of  construction,  etc. 

A schematic  of  the  oxygen  system  is  shown  in  figure  D3-2.  The  ground 
service  lines  are  capped  off  prior  to  flight.  Figure  D3~3  is  a photograph 
of  the  panel  showing  the  terminations  of  these  lines.  The  two  tanks  and 
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Figure  D3-3--  SM  oxygen  system  ground  service  panel. 
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their  plumbing  are  identical  except  for  one  point  in  the  feed  line  from 
tank  no.  2,  at  which  a ground  service  line  tees  into  the  feed  line  down- 
stream of  a check  valve.  This  ground  service  line  permits  the  operation 
of  the  fuel  cells  and  the  environmental  control  system  (ECS)  oxygen  system 
from  a ground  source  of  oxygen  without  requiring  the  use  of  the  flight 
tankage.  This  line  terminates  at  the  fitting  designated  OP  in  figure  D3-3. 
The  check  valve  prevents  the  pressurization  of  tank  no.  2 from  this  ground 
source . 

The  pressure  transducer,  pressure  switch,  and  relief  valve  are  lo- 
cated in  an  oxygen  system  valve  module  external  to  the  tank.  A photograph 
of  the  module  is  shown  in  figure  D3-1+.  Two  of  each  of  these  components 
plus  the  check  valve  for  tank  no.  2 referred  to  in  the  previous  paragraph 
comprise  the  module.  Figure  D3-1+  shows  the  top  of  the  oxygen  shelf.  There 
are  approximately  19  feet  of  feed  line  from  the  tank  pressure  vessel  to 
the  valve  module. 

The  feed  line  exits  the  oxygen  system  valve  module  and  branches , one 
going  to  the  ECS  and  the  other  to  the  fuel  cell  valve  module  where  the 
lines  from  tanks  no.  1 and  no.  2 are  manifolded  within  the  body  of  this 
assembly.  This  module  contains  the  check  valves  at  the  feed  line  entrance 
points  and  three  solenoid  shutoff  valves,  one  for  each  of  the  fuel  cells. 

The  cryogenic  oxygen  electrical  system  consists  of  the  following 
items  for  each  tank: 

1.  Two  electrical  heaters,  rated  at  77-5  watts  each,  28  V dc.  For 
ground  operation,  the  heaters  are  rated  at  1+15  watts  each,  65  V dc.  Four 
wires  exit  the  tank  connector.  The  wiring  of  the  heater  leads  at  the 
pressure  control  assembly  is  such  that  the  two  heaters  are  connected  in 
parallel  to  a single  power  source.  Power  to  the  tank  no.  2 heaters  is 
provided  from  main  bus  B through  a circuit  breaker  and  through  an  on-off 
automatic  switch.  Automatic  operation  is  provided  through  the  pressure 
control  assembly  actuated  by  the  pressure  switches.  The  control  logic 
requires  that  both  oxygen  tank  pressure  switches  be  below  the  low  set- 
point  to  energize  the  heaters.  Either  switch  sensing  pressure  above  the 
high  set-point  will  deenergize  the  heaters. 

2.  Two  motor-driven  fans  rated  at  28.1+  watts  each  (three-phase, 

200/115  V ac).  Eight  wires,  one  for  each  of  the  three  power  phases  plus 
a neutral  for  each  motor,  exit  the  tank  at  the  tank  connector.  They  pro- 
ceed to  a fuse  box  assembly  where  each  of  the  leads  (except  for  the 
grounded  neutrals)  is  individually  fused  by  a 1-ampere  fuse.  Upon  leaving 
the  fuses , the  leads  from  like  phases  of  the  two  motors  as  well  as  the 
neutrals  are  joined  within  the  fuse  box,  and  four  wires  leave  this  assembly. 
The  three  power  leads  then  pass  through  individual  switch  contacts  and 
thence  to  individual  circuit  breakers.  Each  breaker  is  rated  at  2 amperes. 
The  fans  can  be  operated  in  either  a manual  or  automatic  mode. 
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Figure  D3-^.-  Plan  view  of  the  top  of  the  oxygen  shelf. 
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3.  A temperature  sensor,  a platinum  resistance  thermometer  encased 
in  an  Inconel  sheath.  It  is  attached  to  the  outside  of  the  quantity 
probe.  The  resistance  of  the  thermometer  and  consequently  the  voltage 
drop  across  the  unit  changes  with  temperature.  The  signal  conditioner 
which  serves  as  the  reference  voltage  generator  and  amplifier  is  located 
on  the  oxygen  shelf  and  its  input  to  the  resistor  is  current-limited  to 
a maximum  of  1.1  milliamperes . Four  wires  exit  the  tank  connector  and 
are  connected  to  the  signal  conditioner.  The  signal  conditioner  is 
powered  from  ac  bus  2 through  a circuit  breaker  as  a parallel  load  with 
the  quantity  gage  signal  conditioner.  Additional  description  is  provided 
in  Appendix  B. 

4.  A quantity  gage,  a capacitor  consisting  of  two  concentric  alu- 
minum tubes  submerged  in  the  oxygen.  The  dielectric  constant  of  the 
oxygen,  and  consequently  the  measured  capacitance,  changes  in  proportion 
to  its  density.  The  signal  conditioner,  which  serves  as  the  reference 
voltage  generator,  rectifier,  and  amplifier,  is  located  on  the  oxygen 
shelf.  Two  wires  exit  the  tank  connector  and  are  connected  to  the  signal 
conditioner.  The  signal  conditioner  is  powered  from  ac  bus  2 through  a 
circuit  breaker  as  a parallel  load  with  the  temperature  sensor  signal 
conditioner.  Additional  description  is  provided  in  Appendix  B. 

5-  A vac-ion  pump  assembly,  attached  to  the  dome  of  the  tank,  is 
used  only  in  prelaunch  activities  to  maintain  the  tank  annulus  at  the 
required  vacuum  level.  The  pump  functions  by  bombarding  a titanium 
cathode  with  ionized  gas  molecules  and  ion  pumping  results  from  the 
gettering  action  of  sputtered  titanium  particles.  The  high-voltage 
power  supply  of  the  pump  is  an  integral  part  of  the  pump  assembly. 

Leads  for  the  vac-ion  pump  do  not  penetrate  the  pressure  vessel  and  the 
pump  is  not  normally  powered  in  flight. 


ELECTRICAL  SYSTEM  CONFIGURATION  AT  TIME  OF  ACCIDENT 


The  electrical  power  system,  in  general,  provides  multiple  power 
busses  with  switching  options  for  selecting  an  operating  configuration. 
At  55:53:21,  the  electrical  system  was  configured  in  accordance  with 
reference  1,  as  shown  in  figure  D3-55  with  fuel  cells  1 and  2 connected 
to  main  bus  A and  fuel  cell  3 connected  to  main  bus  B.  Inverter  1 was 
connected  to  main  bus  A and  powering  ac  bus  1.  Inverter  2 was  connected 
to  main  bus  B and  powering  ac  bus  2.  Inverter  3 was  not  connected.  Bat- 
tery busses  A and  B were  not  connected  to  main  bus  A or  B.  The  switches 
controlling  heater  operation  for  both  oxygen  tanks  were  in  the  "auto- 
matic" position,  controlling  heater  operation  through  the  pressure  con- 
trol assembly.  Pressures  in  the  oxygen  tanks  were  at  levels  which  did 
not  demand  operation  of  the  heaters . Temperature  and  quantity  sensors 
on  oxygen  tank  no.  2 were  energized  from  ac  bus  2.  The  quantity  gage 
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had  remained  off-scale  high  from  46:40:06,  indicating  a probable  short 
circuit  either  on  the  leads  or  the  probe  assembly.  Operation  of  the  fan 
motors  in  the  oxygen  tanks  was  accomplished  throughout  the  mission  using 
manual  control  in  lieu  of  the  automatic  operation  afforded  by  the  logic 
of  the  pressure  control  assembly.  A routine  operation  of  the  fans  was 
requested  by  the  ground  at  55:52:58  and  acknowledged  by  the  crew  at 
55:53:06.  Energizing  of  the  fans  in  oxygen  tank  no.  1 is  confirmed  by  a 
drop  in  voltage  of  ac  bus  1 and  an  increase  in  total  fuel  cell  current 
at  55:53:18.  Energizing  of  the  fans  in  oxygen  tank  no.  2 is  confirmed 
by  a drop  in  voltage  of  ac  bus  2 and  an  increase  in  total  fuel  cell 
current  at  55:53:20.  Data  substantiating  operation  and  operation  times 
are  presented  in  Appendix  B. 


STRUCTURAL  EVALUATION  OF  THE  OXYGEN  TANK 


The  oxygen  tank  consists  of  two  concentric  shells,  an  inner  shell 
(the  pressure  vessel)  and  an  outer  shell  (fig.  D3-6).  The  space  between 
the  two  shells  is  evacuated  during  normal  operation  and  contains  the 
thermal  insulation  system,  fluid  lines,  and  the  conduit  which  houses  all 
of  the  electrical  wires  entering  the  pressure  vessel. 

The  oxygen  tank  is  discussed  from  the  standpoint  of  materials,  pro- 
cessing, welding,  qualification  program,  stress  levels,  fracture  analysis, 
and  environmental  testing. 


Materials,  Processing,  and  Welding 

Inner  shell.-  The  pressure  vessel  is  made  from  Inconel  718,  a pre- 
cipitation  hardenable  nickel  base  alloy  having  good  strength,  ductility, 
and  corrosion  resistance  over  the  range  of  temperatures  from  -300°  F to 
above  l400°  F.  The  nominal  composition  of  Inconel  718  is  19  percent 
chromium,  17  percent  iron,  0.8  percent  titanium,  5 percent  columbium, 

0.6  percent  aluminum,  and  the  remainder  nickel.  The  heat  treatment 
specified  for  Inconel  718  for  this  application  was  the  following: 

Hold  at  1800°  F ± 25°  F for  1 hour 

Air  cool  to  1325  ± 25°  F and  hold  for  8 hours 

Furnace  cool  to  1150°  F and  hold  for  8 hours 

Air  cool 

This  treatment  should  produce  typical  ultimate  tensile  strength  of 
198,000  psi  and  yield  strength  of  170,000  psi  at  70°  F.  Ultimate  and 
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yield-strength  values  increase  with  decreasing  temperature  and  reach 
228,000  psi  and  189,000  psi,  respectively,  at  -190°  F.  These  values  ex- 
ceed those  assumed  in  the  design  of  the  vessel,  which  were  180,000  psi 
ultimate  tensile  strength  and  150,000  psi  yield  strength  at  room  tempera- 
ture (ref.  2).  After  burst  tests,  tensile  specimens  were  cut  from  test 
vessels  PV-1  and  PV-4,  and  strength  measurements  were  made  at  room  tem- 
perature. Each  specimen  exceeded  minimum  requirements. 

Inconel  7l8  is  considered  to  be  an  excellent  selection  for  use  at 
the  temperatures  required  by  this  design  and  when  properly  cleaned  is 
compatible  with  liquid  oxygen. 

The  pressure  vessel  is  made  by  electron  beam  welding  two  hemispheres 
at  a weld  land  (fig.  D3-7)  that  is  0.139  ± 0.002  inch  thick.  The  weld 
land  is  faired  to  a membrane  of  0.059-inch  thickness  over  a distance  of 
about  2 inches.  Cameron  Iron  Works,  Inc.,  forges  the  hemispheres  to  a 
wall  thickness  of  0.75  inch,  and  applies  the  complete  heat  treatment. 

The  hemispheres  are  X-rayed  following  forging.  The  Airite  Company 
machines  the  hemispheres  to  dimension  and  welds  them  together  from  the 
outside.  First,  an  intermittent  tack  weld  pass  is  made,  followed  by  a 
complete  tack  weld.  The  third  pass  provides  complete  penetration,  and  a 
fourth  pass  penetrates  about  one-third  of  the  thickness.  Finally,  a 
cover  pass  is  made.  Figure  D3-8  illustrates  the  welding  sequence.  The 
weldments  are  X-rayed  and  dye-penetrant  inspected  from  the  outside.  In- 
spection of  the  inside  of  the  pressure  vessel  is  by  visual  means  only 
and  dye  penetrant  is  not  used.  Use  of  one  of  the  available  liquid- 
oxygen-compatible  dye  penetrants  would  enhance  the  detection  of  cracks 
or  similar  weld  defects  inside  the  vessel. 

The  literature  has  very  little  data  on  electron-beam  welding  of 
Inconel  718.  However,  it  is  frequently  used  in  the  aerospace  industry 
and  there  is  no  reason  to  question  the  practice  in  this  instance.  One 
potential  problem  sometimes  found  when  this  nickel-base  alloy  is  welded 
is  micro-f issuring  in  the  heat-affected  zone.  Such  fissures  either  do 
not  propagate  to  the  surface,  or  are  very  difficult  to  detect.  Unfor- 
tunately, high-contrast  X-rays  of  this  material  are  difficult  to  obtain, 
particularly  in  the  configuration  of  this  tank.  No  evidence  of  a weld 
cracking  problem  has  been  found  in  the  manufacture  of  these  pressure 
vessels.  Thus  there  is  no  justification  for  postulating  that  micro- 
fissuring  was  a factor  in  the  accident  being  investigated. 

A total  of  39  data  packages  on  oxygen  pressure  vessels  were  reviewed 
and  it  was  ascertained  that  only  12  vessels  had  had  weld  discrepancies. 
Table  D3-1  describes  the  weld  discrepancies  and  their  disposition. 

Neither  of  the  two  Apollo  13  oxygen  tanks  flown  (S/N  10024XTA0008  and 
S/N  10024XTA0009)  appear  on  this  list.  There  were  no  recorded  weld  dis- 
crepancies during  the  manufacture  of  these  tanks. 
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Joint  configuration 


P/M 

thickness 

Tank  radius 

Dimensions 

L 

T 

O.D. 

I.D. 

1.000 

±.002 

.084 

14.808  ref^ 

12.528 

±005 

-0 

Sph  rad 

2.000 

±.002 

.067 

14.808  refjjfQ 

12.528 

±005 

-0 

Sph  rad 

3.000 

± 004 
•059.  000 

12.587  refarc 

12.528 

±005 

-0 

Sph  rad 

Weld  schedule  (Electron  beam  weld) 

Pass  sequence 

Parameter 

l-tack 

2-seal  3- 

-pene.l 

4-pene. 

.2  5 

Voltage  - Kv 

80 

80 

115 

95 

Amperes  - MA 

1.5 

1.5 

6.0 

4.0 

i 

Beam  deflection  - in. 
Travel  - in. /min 
Vacuum  - mm  hg 


0.012  .024/. 036  .040/080 


0.012 

2X10-4  - 

Notes:  (1)  0.002"  gap,  0.003"  offset  (max  typ) 

(2)  No  weld  repairs  allowed 

(3)  Typical  weld  sequence  shown  on  attached  sketch 


85 
3.0 
0.110 


Figure  D3-7.-  Girth  weld  joint  configuration  and  schedule. 
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TABLE  D3-I. - A TRITE  PRESSURE  VESSEL  WELD  DISCREPANCIES 


Serial  no. 

Spacecraft 

Discrepancy 

XTA0005 

101 

Weld  bead  0.005  inch  concave  by  0.600-inch 
length.  Remainder  undercut  0.002  inch  below 
weld  land  parent  metal.  Accepted  based  upon 
X-ray  and  comparison  to  qual.  unit  used  in 
burst.  Beech  MRR. 

XTAOOIO 

103 

Undercut  below  weld  land  in  one  area  0.0015 
inch  deep  by  0.750  inch  length  adjacent  to 
upper  hemisphere.  Due  to  heavy  weld  drop- 
through.  Accepted  for  unrestricted  use  by 
m MRD. 

XTA0013 

106 

Hemisphere  dimensional  characteristics  re- 
sulted in  excessive  weld  mismatch.  Units  were 
successfully  welded  after  HR  MRD.  Finished 
vessel  met  all  requirements. 

XTA0016 

107 

Four  areas  of  concavity  in  center  of  weld 
bead:  no.  1,  0.0025  inch  depth;  no.  2,  0.0055 
inch  depth;  no.  5?  0.0045  inch  depth;  no.  4, 
0.0025  inch  depth.  Concavity  due  to  excessive 
drop- through.  Re welded  using  two  360-degree 
weld  passes  in  accordance  with  NR  MRD. 

After  rework  of  above,  three  areas  of  con- 
cavity remained:  no.  1,  0.0025  inch  below 

parent  metal;  no.  2,  0.004  inch  below  parent 
metal;  no.  3>  0.0015  inch  below  parent  metal. 
Warpage  occurred  due  to  lack  of  constraint. 
Accepted  for  unrestricted  usage  per  NR  MRD 
based  upon  positive  margins  of  safety. 

XTA0022 

110 

Borescope  showed  entire  weld  land  visible  and 
not  consumed  through  360-degree  circumference 
due  to  lack  of  penetration.  Re welded  per  NR 
MRD  instructions. 

XTA0017 

110 

Borescope  revealed  lack  of  drop-through  in  an 
area  1/2  inch  in  length.  Re welded  by  one  360- 
degree  pass  per  NR  MRD. 

Edge  of  weld  on  upper  hemisphere  undercut  from 
0.001  inch  to  0.003  inch  into  parent  material 
for  360  degrees  following  re welding  per  above-- 
reworked  and  accepted  by  NR  MRD  based  upon 
stress  analysis. 
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TABLE  D3-I.-  AIRITE  PRESSURE  VESSEL  WELD  DISCREPANCIES  - Concluded 


Serial  no. 

Spacecraft 

Discrepancy 

XTA0024 

111 

Hemisphere  dimensional  characteristics  out  of 
specification.  Units  successfully  welded  after 
certification  test  specimens  duplicating  con- 
ditions were  acceptable.  Discrepancies  were 
consumed  during  welding.  Beech  MRR. 

XTA0021 

111 

Incomplete  weld  penetration  for  a distance  of 
17-3/8  inches.  Re welded  per  HR  MRD. 

XTA0033 

Unassigned 

Upper  hemisphere  dimensions  out  of  specifica- 
tion. Accepted  for  welding  with  fit  up  with 
another  hemisphere.  Beech  MRR. 

XTA0019 

Unassigned 

Borescope  revealed  complete  weld  land  (0.012 
inch)  still  visible-repair  welded  per  NR  MRD. 

XTA0003 

Unassigned 

Borescope  and  X-ray  revealed  incomplete  pene- 
tration major  distance  of  weld.  Rewelded  per 
Airite  procedure.  Beech  MRR. 

Weld  concavity  from  0.001  to  0.0055  inch  deep 
on  drop-through  side  of  weld  on  upper  hemis- 
phere. Maximum  width  is  0.003  inch-accepted 
for  unrestricted  use  by  NR  MRD. 

XTA0032 

Unassigned 

Borescope  revealed  area  approximately  0.600 
inch  long  with  incomplete  consumption  of  weld 
lands.  X-ray  indicated  complete  penetration. 
Rewelded  by  Airite  procedure.  Beech  MRR. 
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Outer  shell.-  The  outer  shell  is  made  of  Inconel  750,  also  a nickel 
base  alloy  having  the  following  nominal  composition:  15  percent  chromium, 

7 percent  iron,  2.5  percent  titanium,  1 percent  columbium,  0.7  percent 
aluminum,  and  the  remainder  nickel.  According  to  references  5 and  4,  the 
outer  shell  can  be  annealed.  Typical  strength  values  for  the  annealed 
alloy  are  150,000  psi  ultimate  strength  and  60,000  psi  yield  strength. 

This  is  more  than  adequate  for  this  application.  The  wall  thickness  of 
the  outer  shell  is  0.020  ± 0.002  inch.  When  the  space  between  the  two 
shells  is  evacuated,  the  outer  shell  preloads  the  insulation  between  the 
two  shells.  The  dome  of  the  outer  shell  contains  a burst  disc  designed 
to  vent  the  space  between  the  shells  to  ambient  pressure  at  a pressure 
differential  of  75  - 7-5  psi. 

Cryogenic  tank  tubing.-  Three  fluid  lines  (fill  line,  vent  line,  and 
feed  line),  and  an  electrical  conduit  are  fusion  welded  to  the  close-out 
cap  (tube  adapter)  that  is  screwed  into  the  top  of  the  pressure  vessel. 

The  cap  is  secured  to  the  pressure  vessel  by  a circumferential  seal  weld. 
The  four  lines  are  made  of  Inconel  750,  annealed  Aerospace  Materials 
Specification  (AMS)  5582.  The  tubes  traverse  the  space  between  the  two 
shells  and  exit  the  outer  shell  at  the  side  of  the  tank  coil  cover.  The 
nominal  strength  of  the  annealed  tubing  is  140,000  psi  ultimate,  and 
80,000  psi  yields,  which  is  more  than  adequate  for  the  application,  as 
the  stress  level  in  the  tubing  is  only  about  17,000  psi. 

After  the  tubes  are  welded  to  the  cap,  a visual  inspection,  helium 
leak  test  (3  psi),  and  proof-pressure  tests  are  used  to  assess  the 
quality  of  these  welds  (ref.  5).  This  is  reasonable  because  of  the  low 
stress  levels  involved.  Li quid-oxygen- compatible  dye  penetrant  inspec- 
tion and  subsequent  cleaning  would  enhance  the  possibility  of  finding 
surface  cracks.  X-rays  of  these  welds  would  be  difficult  to  obtain  and 
should  be  of  dubious  value. 

The  four  lines  extend  only  a few  inches  from  the  tank  dome.  When 
the  tank  is  assembled  on  the  oxygen  subsystem  shelf,  the  fluid  tubes  are 
joined  by  brazing  to  the  304L  annealed  corrosion  resistant  steel  tubes 
of  the  spacecraft  systems.  Although  joining  Inconel  750  and  304L  steel 
constitutes  a bimetallic  couple,  it  is  satisfactory  in  this  application 
because  of  the  dry  environment  that  is  maintained. 


Qualification  Program 

The  pressure  vessel  qualification  program  was  conducted  by  Beech 
Aircraft  Corporation.  Four  pressure  vessels  were  subjected  to  burst 
tests  as  described  in  references  6 through  12. 

Prior  to  each  burst  test,  the  vessel  was  subjected  to  an  acceptance 
pressure  test  at  1357  psig  and  checks  were  made  for  leaks.  No  leaks  were 
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observed  in  any  of  the  vessels.  In  Appendix  F of  reference  9?  there  is 
an  analysis  of  the  proof  test  of  vessel  PV-4.  The  following  table  lists 
some  of  the  strain  gage  readings  taken  during  the  qualification  testing. 

MEASURED  STRESS  LEVELS  IE  KSI 


Internal 

2.8  inches 

2.0  inches 

Lower 

Membrane 

Tank 

pressure , 

from 

from 

pole 

(0. 06l-inch 

psig 

upper  pole 

girth  weld 

. area 

thick) 

Tank  PV-4 

1020 

108.3^ 

106.1 

97-7 

105.8 

70°  F 

1357 

139.7b 

139-4 

128.9 

- 

Tank  PV-1 
-320°  F 

1020 

1 

116.7 

113 

- 

- 

aDesign  value  110  ksi 


^Design  value  145  ksi 

For  the  cryogenic  burst  tests,  the  vessels  were  filled  with  liquid 
nitrogen  and  placed  in  an  open  dewar  of  liquid  nitrogen.  The  ambient 
temperature  burst  tests  used  water  as  the  pressuring  medium.  The  burst 
pressures  of  the  qualification  vessels  were  as  follows: 


Tank 

Test  condition 

Burst  pressure,  psig 

PV-1 

Cryogenic  (LE  , -320°  F) 

2233 

PV-2 

Cryogenic  (LE^,  -320°  F) 

2235 

PV-3 

Ambient  temperature  (70°  F) 

1873 

pv-4 

Ambient  temperature  (70°  F) 

1922 

All  ruptures  were  similar;  the  failures  apparently  started  about 
2 or  3 inches  from  the  pole  of  the  tank  on  the  top  at  the  transition 
from  the  heavier  section  to  the  membrane  section.  The  fractures  pro- 
gressed around  the  boss  area,  proceeded  essentially  perpendicular  to  the 
girth  weld,  and  then  crossed  the  girth  weld  in  both  ambient  tests  and  in 
one  of  the  cryogenic  tests.  In  the  other  cryogenic  temperature  test 
vessel,  a large  fragment  came  out  of  the  upper  hemisphere.  In  no  case 
was  there  violent  fragmentation.  After  the  burst  of  PV-1  at  2233  psig, 
initial  failure  was  judged  to  have  occurred  at  the  end  of  the  neck  taper 
around  the  top  pole.  The  rupture  progressed  downward,  branching  into  a 
Y.  After  coming  into  contact  with  the  weld,  the  rupture  followed  the 
weld  fusion  zone. 
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The  following  is  a quotation  from  reference  9* 


"2.3*7  Conclusions  - Based  on  the  above  analysis  and 
evaluation,  the  following  conclusions  are  made: 

(1)  Burst  failure  initiated  at  the  end  of  the 
boss  taper  in  the  upper  hemisphere  and  resulted 
from  plastic  deformation  beyond  the  tensile 
strength  of  the  base  material  at  ambient  tem- 
perature . 

(2)  Rupt  urs  was  of  a hydrostatic  type. 

(j)  The  appearance  of  all  failed  areas  was 
judged  to  indicate  good  ductility  of  the  base 
metal  and  weldments. 

(4)  No  significant  mismatch  was  observed  on 
the  specimens  investigated. 

(5)  All  fractures  across  the  weld  were  shear 
fractures  and  of  a secondary  nature. 

(6)  The  grain  size  throughout  the  vessel  was 
fine  (ASTM-5  to  8)  and  relatively  equiaxed. 

(7)  The  ambient  burst  test  was  judged  to  be 
completely  successful  by  Beech  Aircraft  Cor- 
poration Engineering,  and  the  results  of  the 
test  indicate  approximately  100  percent  ef- 
ficiency for  the  material  at  the  test  tem- 
perature , " 

The  data  from  these  pressure  vessel  tests  satisfy  the  qualification 
requirement  for  an  ultimate  factor  of  safety  of  1.5  at  ambient  tempera- 
ture with  adequate  margins. 

In  1967  North  American  Rockwell  verified  analytically  the  structural 
integrity  of  the  oxygen  tank  (ref.  13).  An  M3C  structural  analysis  re- 
port (ref.  14),  also  issued  in  1967,  confirmed  the  structural  integrity 
of  these  tanks  and  compared  the  analysis  with  the  results  of  the  burst 
tests.  This  comparison  showed  good  correlation  between  analytical  and 
test  results.  The  MSC  calculations  were  based  on  minimum  guaranteed 
sheet  thicknesses  and  minimum  material  properties.  Even  better  correla- 
tion is  obtained  by  using  the  actual  thicknesses  and  material  properties 
of  the  test  items. 
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These  analyses  show  the  maximum  stresses  in  the  tank  during  pressur- 
ization to  be  in  the  upper  spherical  shell  at  the  transition  from  the 
constant  thickness  shell  to  the  thickened  area  adjacent  to  the  penetra- 
tion port.  Actual  stresses  determined  from  strain  gage  readings  during 
burst  tests  are  consistent  with  the  analyses. 


FRACTURE  MECHANICS 


The  design  of  the  supercritical  oxygen  tank  was  based  on  conven- 
tional elastic  stress  analysis  which  assumes  a homogenous  material  and 
uses  the  conventional  tensile  properties  for  the  calculation  of  safety 
factors.  In  reality,  all  fabricated  materials  contain  crack-like  flaws 
which  may  be  associated  with  weld  defects  or  with  metallurgical  segrega- 
tions which  can  transmit  only  negligible  loads  across  their  boundaries. 
The  load-carrying  capacity  of  high-strength  materials,  particularly  in 
thick  sections,  may  be  severely  reduced  by  the  presence  of  even  small 
flaws  which  can  trigger  a brittle  catastrophic  failure  at  loads  well 
below  those  considered  safe  by  conventional  design  procedures.  Further- 
more, in  many  cases  the  type  of  flaw  present  cannot  be  found  by  non- 
destructive inspection  techniques  and,  for  this  reason,  a proof  test 
must  be  depended  upon  to  identify  those  structures  which  might  fail  in 
service . 

At  the  outset  it  should  be  appreciated  that  linear  elastic  fracture 
mechanics  and  the  associated  American  Society  of  Testing  Materials  (ASTM) 
Standard  Method  of  Test  for  Plane  Strain  Fracture  Toughness,  K.,  are  not 

directly  applicable  to  an  analysis  of  the  fracture  of  the  oxygen  pressure 
vessel  material  in  the  thicknesses  employed,  or  for  that  matter  in  very 
much  larger  thicknesses.  The  evidence  for  this  lies  in  early  results 
from  a fracture  test  program  now  underway  at  Boeing.  These  results  in- 
dicate that  specimens  containing  deep  cracks  in  parent  metal,  or  in 
electron  beam  weld  metal  representative  of  the  oxygen  pressure  vessel, 
fail  at  net  stresses  very  close  to  or  slightly  above  the  corresponding 
yield  strength  whether  they  are  tested  at  70°  F or  -190°  F.  While  the 
plane  strain  fracture  toughness,  K^,  cannot  be  determined  from  the  data 

available,  a lower  bound  estimate  may  be  made  from  test  results  reported 
on  2-3/4  inch  diameter  notched  round  bar  specimens  (ref.  15).  These 
large  specimens  were  cut  from  forgings  of  Inconel  718  and  tested  at 
-110°  F.  The  corresponding  yield  strength  was  about  172  ksi  and  the 
notch  strength  was  40  percent  above  the  yield  strength.  Formal  calcula- 
tions give  an  "apparent  K_"  value  of  190  ksi  -V  in.  which  may  be  taken 

as  a lower  bound  for  a yield  strength  of  172  ksi.  This  is  approximately 
equal  to  the  70°  F parent  metal  yield  strength  of  the  oxygen  pressure 
vessel.  Properly  made  electron  beam  weldments  should  have  at  least  this 
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high  a K value  since  they  are  not  heat  treated  after  welding  and  there- 
fore have  a lower  yield  strength  than  the  parent  metal.  At  -I9O0  F the 
yield  strength  of  the  parent  and  weld  metal  will  increase  about  10  per- 
cent; however,  for  this  austenitic  alloy  the  corresponding  change  in 
toughness  would  be  expected  to  be  negligible. 


Failure  Modes 


While  "apparent  Kj  ” values  should  not  be  used  to  develop  relations 

between  tank  wall  stress  and  critical  flaw  size,  the  lower  bound  value 
°f  Kjc  can  be  used  to  show  that  the  pressure  vessel  would  not  fail  in 

a brittle  manner.  When  the  parameter  Pjc>  the  ratio  of  crack  tip 

plastic  zone  size  factor  to  specimen  thickness,  is  greater  than  1-1/2, 
brittle  fracture  is  very  unlikely.  This  parameter  is  given  by 


3 


Ic 


1 

B 


For  the  oxygen 
is  0.111  inch; 

(table  D3-H), 


tank  B the  effective  weld  land  thickness  after  welding 

the  yield  strength  of  the  weld  F.  is  110  ksi  at  -190° 

ty 

and  the  lower  bound  of  KT  is  190  ksi  - W in. 


Ic 


F 


TABLE  D3-II.-  TYPICAL  PARENT  METAL  AND  WELD  TENSILE  PROPERTIES3, 


Temperature , 0 F 

Parent  metal 

F,  - ksi  F,  - ksi 

tu  ty 

Weld  metal 

F - ksi  F,  - ksi 

tu  ty 

-190 

228 

189 

187 

bno 

70 

198 

170 

158 

100 

Determined  by  Boeing  on  Inconel  718  forgings  using  same  heat 
treatment  given  the  oxygen  pressure  vessel  and  on  electron  beam  weld- 
ments given  no  heat  treatment. 

13 Gage  length  equal  to  weld  width. 


Using  these  values,  0 ^ = 27*  A similar  calculation  for  the  parent  metal 

in  the  membrane  yields  0Ic  = l6.  On  this  basis,  the  mode  of  failure 

of  the  pressure  vessel  would  be  expected  to  be  ductile  tearing  rather 
than  shattering.  However,  it  is  not  known  whether  this  mode  would  lead 
to  a stable  through-thickness  crack,  and  a consequent  slow  leak  into 
the  space  between  the  pressure  vessel  and  the  outer  shell,  or  to  a 
rapid  tearing  fracture  with  consequent  destruction  of  the  outer  shell 
and  the  quick  release  of  a large  volume  of  oxygen.  Which  of  these  two 
possibilities  is  most  likely  depends  in  part  on  the  flaw  size  giving 
rise  to  the  final  fracture  and  on  the  rate  of  depressurization  as  compared 
with  the  rate  of  crack  propagation.  To  settle  this  matter  would  require 
burst  tests  on  intentionally  flawed  tanks. 

If  a local  area  of  the  pressure  vessel  wall  or  the  tube  adapter 
were  heated  to  a sufficiently  high  temperature  by  some  internal  or 
external  source,  the  tank  would  blow  out  at  this  local  area.  According 
to  data  furnished  by  Boeing  under  contract  to  NASA,  the  strength  of 
Inconel  718  would  degrade  rapidly  if  the  metal  temperature  exceeded  about 
1200°  F.  At  lH00°  F the  tensile  strength  would  be  about  50  percent  of 
the  room  temperature  value , and  at  l600°  F would  be  less  than  30  percent 
of  this  value.  At  a tank  pressure  of  1008  psi,  the  parent  metal  wall 
stress  based  on  membrane  theory  is  about  108  ksi.  A ductile  rupture  at 
this  stress  would  likely  occur  if  the  tank  were  at  a uniform  temperature 
of  1^00°  F.  The  restraining  effect  of  the  cool  surrounding  metal  would 
raise  the  temperature  required  for  a local  blowout  and  this  situation 
is  best  evaluated  by  suitable  experiments. 


Effectiveness  of  the  Proof  Test 

The  proof  test  is  the  last,  and  should  be  the  best,  flaw  detection 
procedure  applied  to  a pressure  vessel.  Ideally,  the  proof  test  should 
cause  failure  if  there  are  any  flaws  present  that  could  grow  to  a critical 
size  during  subsequent  pressurization.  For  the  oxygen  tanks  in  question, 
a fracture  mechanics  analysis  cannot  be  made  to  assess  the  adequacy  of 
the  proof  test  because  of  the  high  toughness  of  the  material  and  the 
thin  sections  used.  These  factors  in  themselves,  of  course,  contribute 
to  the  confidence  that  can  be  placed  in  the  integrity  of  the  pressure 
vessel  and,  as  discussed  in  the  previous  section,  essentially  rule  out 
the  possibility  of  brittle  failure.  However,  it  is  worthwhile  to  estimate 
the  effectiveness  of  the  proof  test  in  identifying  those  pressure  vessels 
which  might  develop  leaks  during  pressure  cycles  subsequent  to  proof. 

The  failure  model  proposed  considers  the  plastic  instability  fracture  of 
a ligament  of  material  produced  by  incomplete  fusion  during  electron 
beam  welding.  The  main  features  of  this  model  are  illustrated  in  fig- 
ure D3-9-  It  essentially  represents  a long  flaw  in  the  tank  wall  at  the 
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Area  of  lack  of  fusion  produces 
an  effective  crack  of  depth  A 
& length  2C  in  tank  wall  of 
thickness  B.  2C»A 

Figure  D3-9.-  Ligament  model  for  ductile  fracture  of  pressure  vessel. 
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equatorial  weld.  It  is  postulated  that  the  ligament  will  fail  when  its 
stress  reaches  the  tensile  strength  of  the  material.  Calculations  show 
that  the  ligament  stress  is  related  to  the  average  wall  stress 


a as  follows : 

g 


where  the  dimensions  are  defined  in  figure  D3-9.  The  maximum  relative 
flaw  depth  that  can  he  sustained  without  failure  is  then 


A 


£ = i . JL- 

B F. 

tu 


(1) 


where  F^  is  the  ultimate  tensile  strength.  Failure  will  occur  by 

tearing  of  the  ligament  accompanied  by  rapid  decompression  of  the  tank. 
It  should  be  appreciated  that  this  is  a rather  crude  model  of  ductile 
fracture,  and  will  probably  overestimate  the  failure  stresses  in  a 
spherical  vessel.  However,  it  should  be  useful  in  assessing  the  effec- 
tiveness of  the  proof  tests  in  light  of  subsequent  service,  because  of 
the  very  large  margins  between  proof  and  operating  pressures. 


The  pressure  cycles  applied  to  the  Apollo  13  oxygen  tank  no.  2 
are  shown  in  table  D3-III.  It  should  be  noted  that  the  oxygen  tank  no.  2 
had  several  extra  pressure  cycles  in  addition  to  those  normally  applied. 
These  were  associated  with  rechecks  for  heat  leaks  and  with  the  "shelf 
dropM  incident.  The  additional  cycles  do  not  affect  this  analysis  nor 
should  they  have  reduced  the  integrity  of  the  tank  during  mission 
service. 


The  ratio  of  tank  pressures  necessary  to  cause  ligament  failure  for 
a given  relative  flaw  size  A/B  at  two  temperatures  will  be  equal  to  the 
ratio  of  the  tensile  strength  of  the  material  at  these  temperatures.  On 
this  basis,  the  maximum  flaw  size  that  could  exist  before  CDDT  is  estab- 
lished by  the  last  high  pressure  helium  proof  specified  as  1260  psi 

at  ambient  temperature  (1276  psi  for  oxygen  tank  no.  2).  From  equation 
(l),  the  corresponding  value  of  A/B  for  the  weld  metal  is  0.55>  based  on 
a weld  tensile  strength  of  158  ksi  at  room  temperature,  a weld  land 
thickness  of  about  0.111  inch,  and  a nominal  weld  land  stress  of  71  ksi. 

The  question  now  arises  as  to  whether  a flaw  of  this  size  could 
propogate  through  the  wall  during  subsequent  pressurization  and  produce 
a leak.  Flaw  growth  could  occur  by  sustained  loads  or  cyclic  loads.  In 
the  absence  of  an  aggressive  environment,  it  is  generally  recognized 
that  sustained  load  flaw  growth  will  not  occur  at  loads  less  than  90 
percent  of  that  necessary  to  produce  failure  in  a continuously  rising 
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TABLE  D3-III.-  HISTORY  OF  PRESSURE  CYCLES  APPLIED  TO  APOLLO  13 
SUPERCRITICAL  OXYGEN  TANK  NO.  2 


[ Record  from  North  American  Rockwell  Space  Division  I 


Organization 

Test  media 

Date 

Peak  pressure, 
psi 

(a),  (b) 

Time , 
hrrmin 

Test  name 

Beech 

H20  + He 

6-20-66 

1336 

00:24 

Pressure  vessel, 
acceptance 

Beech 

gn2 

7-15-66 

1340 

00:56 

Internal  leak  check 
on  complete  assembly 

Beech 

ln2 

7-15-66 

920 

00:51 

Cold  shock 

Beech 

gn2 

9-15-66 

C1333 

00:54 

Internal  leak  check 

Beech 

ln2 

9-15-66 

c918 

00:51 

Cold  shock 

Beech 

Helium 

10-19-66 

1303 

09:49 

Proof  and  leak 

Beech 

Helium 

10-19-66 

888 

01:00 

Proof  and  leak 

Beech 

LOX 

12-20-66 

1333 

40:05 

dq/dm 

Beech 

LOX 

10-24-66 

922 

25:04 

dq/dm 

Beech 

Helium 

1-51-67 

C1305 

09:07 

Proof  and  leak 

Beech 

LOX 

2-  2-67 

C1321 

28:39 

dq/dm 

Beech 

LOX 

2-  3-67 

C920 

22:16 

dq/dm 

NAR-SD 

Helium 

4 -29-68 

1262 

06:45 

Le  ak 

NAR-SD 

Helium 

5-  1-68 

1002 

01:00 

Leak 

NAR-SD 

Helium 

5-  1-68 

968 

13:13 

Leak 

NAR-SD 

Helium 

5-  2-68 

1104 

08:02 

Leak 

NAR-SD 

Helium 

5-27-68 

C>d1262 

02:54 

Leak 

NAR-SD 

Helium 

5-28-68 

C1102 

01:07 

Leak 

NAR-SD 

Helium 

11-18-68 

d1276 

02:24 

Leak 

NAR-SD 

Helium 

n-18-68 

1002 

01:40 

Leak 

NAR-SD 

Helium 

7-17-69 

1025 

01:39 

Leak 

NAR-SD 

LOX 

4-  9-70 

925 

43:53 

Launch  loading 

^Pressure  cycles  below  400  psi  not  recorded 
it  could  not  be  determined  whether  pressure  measurements  represented  psia  or  psig 
CPressure  cycles  not  normally  applied 

d1260  + ^ psi  specification 
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load  test.  Following  the  1276  psi  helium  proof  test,  no  subsequent 
pressurization  exceeds  85  percent  of  this  pressure,  and  consequently 
sustained  load  flaw  growth  is  extremely  unlikely.  Confidence  in  this 
conclusion  can  be  obtained  from  the  test  results  of  a Boeing  program 
now  underway.  These  results  apply  to  specimens  containing  small  but 
deep  cracks  in  both  parent  metal  and  electron  beam  weld  metal  of  Inconel 
718  forgings  heat  treated  in  the  same  way  as  the  oxygen  tank  material. 

The  early  data  show  no  crack  growth  in  20  hours  at  -190°  F for  specimens 
subjected  to  l60  percent  of  the  nominal  operating  stress. 

Cyclic  loads  during  the  flight  operation  would  be  caused  by  cyclic 
operation  of  the  heaters  (about  once  per  one-half  hour) . The  associated 
pressure  cycles  are  very  small  with  a minimum- to-maximum  stress  ratio 
of  about  0.95-  Flaw  growth  due  to  these  small  cyclic  loads  is  con- 
sidered extremely  unlikely  during  the  mission  for  the  following  reason: 
maximum  nominal  operating  stress  in  the  weld  land  (at  935  psi)  is  about 
28  percent  of  the  weld  tensile  strength  at  -190°  F.  Therefore,  with  a 
flaw  size  of  A/B  = 0.55?  the  ligament  stress  would  be  only  about  65  per- 
cent of  the  weld  tensile  strength.  On  the  basis  of  the  known  fatigue 
behavior  of  Inconel  718  welds  (ref.  16),  it  would  be  expected  that 
ligament  failure  due  to  cyclic  loads  induced  by  heater  operation  would 
not  be  a consideration  until  hundreds  of  cycles  had  been  accumulated. 
Confidence  in  this  conclusion  can  be  obtained  from  the  early  results  of 
the  previously  mentioned  on-going  Boeing  program.  These  results  in- 
dicate that  parent  and  electron  beam  weld  metal  specimens  of  Inconel  718 
containing  small  but  deep  cracks  do  not  show  crack  growth  at  -I9O0  F 
after  15,000  cycles  at  minimum-to-maximum  stress  ratio  of  0.95  and  a 
mean  stress  of  about  170  percent  of  the  nominal  operating  value. 

While  the  conclusions  based  on  the  ligament  model  are  consistent 
with  the  Boeing  data  obtained  from  specimens  with  small  flaws,  these 
test  results  cannot  be  used  to  prove  the  validity  of  the  model  because 
it  applies  to  large  flaws.  Therefore,  it  is  planned  to  check  the  con- 
clusions reached  on  the  basis  of  this  model  by  testing  specimens  at 
MSC  which  will  contain  large,  deep  cracks.  Specimens  of  both  electron 
beam  welds  and  parent  metal  will  be  subjected  at  -190°  F to  the  mean 
and  cyclic  stresses  encountered  in  flight  operation  of  the  oxygen  tank. 

In  assessing  the  effectiveness  of  the  proof  test,  no  consideration 
was  given  to  the  possibility  of  failure  in  regions  remote  from  the  welds 
(e.g.,  the  main  membrane  or  neck  of  the  vessel).  Conventional  stress 
analysis  (ref.  lU)  shows  that  the  highest  stresses  occur  in  the  transition 
region  between  the  weld  lands  and  the  uniform  thickness  membrane.  Stresses 
in  the  neck  region  are  very  low  and  comparable  to  those  in  the  weld  land. 
The  ligament  model  is  not  applicable  to  these  regions  of  the  vessel 
remote  from  the  weld  since  there  is  no  clear  mechanism  by  which  a large 
flaw  could  be  introduced  into  the  parent  metal.  Experience  shows  that 


crack-like  imperfections  are  sometimes  introduced  by  the  forging  process, 
but  these  are  relatively  small  and  confined  to  the  surface  layers  of  the 
forging*  Such  defects  are  easy  to  detect  and  are  usually  removed  by 
the  machining  process.  It  is  the  standard  practice  of  the  aerospace 
industry  to  reject  forgings  that  have  cracks  that  cannot  be  removed  by 
machining.  With  this  in  mind,  there  is  no  reason  to  doubt  the  effective- 
ness of  the  final  high-pressure  helium  proof  test  insofar  as  the  pressure 
vessel  main  membrane  area  is  concerned. 


Possibility  of  Tank  Failure  During  Apollo  13  Mission 

On  the  basis  of  the  foregoing  information,  it  is  extremely  unlikely 
that  the  oxygen  tank  no.  2 pressure  vessel  ruptured  at  the  maximum  record- 
ed flight  pressure  of  1008  psi  and  temperature  of  -l60°  F because  of  crack 
propagation.  Based  on  the  previously  described  ligament  model,  a 
pressure  vessel  passing  the  last  high-pressure  helium  proof  test  should 
withstand  a pressure  load  nearly  twice  that  of  the  maximum  flight 
pressure  at  -l60°  F.  As  described  previously,  a high-temperature  blowout 
of  the  pressure  vessel  is  entirely  possible,  and  if  this  occurred  the 
fluid  released  could  have  caused  rupture  of  the  dome  or  of  the  outer  shell. 


DYNAMIC  TESTING 


During  the  development  and  qualification  of  the  command  and  service 
modules  (CSM),  a series  of  dynamic  tests  was  conducted  on  major  vehicle 
elements  as  well  as  subassemblies.  The  following  sections  describe 
those  tests  applicable  to  the  cryogenic  oxygen  tank. 


Oxygen  Tank  Assembly  Dynamic  Testing 

Dynamic  testing  was  accomplished  during  September  1966.  Flight-type 
oxygen  tank  assembly  hardware,  selected  as  a test  specimen,  successfully 
completed  this  testing  as  documented  in  reference  IT. 

Vibration  testing.-  The  test  specimen  was  subjected  to  vibration 
in  each  of  three  axes  , and  the  vibration  level  was  maintained  for  15  minutes 
in  each  axis.  The  specified  test  levels,  representing  the  combined  envelope 
of  the  atmospheric  and  space  flight  conditions,  were  as  follows: 
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10 

0.003 

10-90 

0.003  to  0.025  at 

3 dB/octave 

90-250 

0.025 

250-400 

0.025  to  0.015  at 

3 dB/octave 

400-2000 

0.015 

The  test  spectrum  is  shown  as  the  solid  line  in  figure  D3-10.  No  signifi- 
cant anomalies  were  recorded  during  these  tests.  These  tests  qualified 
the  oxygen  tank  assembly  for  the  launch  and  space  flight  conditions. 

Acceleration  testing.-  The  oxygen  tank  assembly  used  in  the  vibra- 
tion testing  mentioned  in  the  preceding  paragraph  was  also  tested  for 
acceleration  in  each  of  three  axes  for  at  least  5 minutes  in  each  di- 
rection. The  acceleration  was  Tg  in  the  launch  axis  direction  and 
3g  in  the  other  two  orthogonal  axes.  These  accelerations  are  greater 
than  those  expected  during  normal  ground  handling  or  during  flight.  No 
anomalies  were  recorded  during  these  tests. 


Apollo  CSM  Acoustic  and  Vibration  Test  Program 

In  addition  to  the  dynamic  testing  previously  described,  the  oxygen 
tank  and  shelf  assemblies  plus  other  CSM  subsystems  were  tested  as  part  of 
the  Block  II,  Spacecraft  105/AV  Certification  Test  Program  conducted 
during  February  and  March  1968  (ref.  18).  These  tests  qualified  the 
Block  II  CSM  hardware  against  the  acoustic  and  vibration  criteria,  and 
confirmed  the  structural  integrity  of  the  CSM  for  vibration  inputs  which 
enveloped  the  complete  ground  and  flight  environmental  requirements  as 
specified  in  reference  19. 

Figure  D3-11  shows  the  transducer  locations  used  for  both  the  acous- 
tic and  vibration  testing.  Test  instrumentation  in  the  area  of  the 
oxygen  tank  was  as  follows: 

SA  110  (+X)  Oxygen  shelf  on  bracket,  18  inches  from  beam  4 

SA  111  (-R)  Oxygen  shelf  on  bracket,  18  inches  from  beam  4 

SA  112  (-T)  Oxygen  shelf  on  bracket,  18  inches  from  beam  4 

SA  113  (+X)  Oxygen  shelf  on  centerline 

Note:  R = radial,  T = tangential 
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Acceleration  spectral  density,  g^/Hz 


Frequency,  Hz  (cps) 

Figure  D3-10.-  Service  module  data  overlays  and  specified  test  spectrum 
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Figure  D3-11.-  Spacecraft  105/AV  service  module  instrumentation,  bay  4. 


D-33 


Vibration  testing  consisted  of  sinusoidal  sweeps  in  the  4-  to  30-Hz 
range,  followed  by  sinusoidal  dwells  at  the  prominent  resonance  fre- 
quencies. CSM  vibration  response  was  controlled  to  0. 075-inch  double 
amplitude  for  the  4-  to  8-Hz  frequency  range  and  O.lg  peak  for  the  7- 
to  30-Hz  frequency  range. 

Acoustic  tests  were  performed  to  measure  the  vibratory  response 
in  the  20-  to  2000-Hz  frequency  range.  The  acoustic  spectrum  of 
interest  for  the  oxygen  tank  was  adjusted  to  obtain  a test  spectrum  as 
shown  in  figure  D3-10. 

The  vibration  and  acoustic  tests  were  completed  without  failures 
or  any  pertinent  anomalies  in  the  oxygen  tank  or  tank  shelf.  The 
maximum  observed  accelerations  during  the  tests  are  given  in  the 
following  table: 


Inst.  no. 

Vibration 

Acoustic 

X-axis 

4-  to  30-Hz  sweep, 
g (rms) 

Z-axis 

4-  to  30-Hz  sweep, 
g (rms) 

X-axis 

4-  to  30-Hz  sweep, 
g (rms) 

SA  110 

0.02 

0.05 

0.005 

SA  111 

• 5 

.5 

.35 

SA  112 

.5 

.6 

.6 

SA  113 

.15 

.1+ 

• IT 

The  responses  of  four  transducers  (SA  107  through  SA  109  and 
SA  113)  are  shown  in  figure  D3-10. 

The  tests  confirmed  the  following: 

1.  Structural  integrity  of  Block  II  CSM  wiring,  plumbing, 
bracketry,  and  installed  subsystems  when  subjected  to  the  dynamic  loads 
resulting  from  spacecraft  exposure  to  the  aerodynamic  noise  environment 
expected  during  atmospheric  flight. 

2.  Structural  integrity  of  the  Block  II  CSM  when  it  is 
experiencing  the  low  vibratory  motions  produced  by  atmospheric  flight. 


Based  upon  "the  results , it  is  concluded  that  the  tests  were  ade- 
quate to  qualify  the  CSM  for  flight  on  the  Saturn  V.  Of  course,  this 
qualification  would  not  necessarily  cover  abnormal  conditions  such  as 
mishandling. 


SHOCK  TESTING 


Although  NR  specification  (ref.  20)  requires  qualification  testing 
of  the  oxygen  tank  assembly  inside  its  shipping  container  for  ground 
handling  and  transportation  conditions,  further  investigation  revealed 
that  this  requirement  was  deleted  on  January  8,  1965.  This  deletion  is 
documented  in  paragraph  3. 8. 4. 5 of  reference  21,  which  states,  "Revised 
Apollo  Test  Requirements,  no  testing  of  transportation  and  ground  hand- 
ling environments  (shall  be  required).  Packaging  is  designed  to  pre- 
clude exposure  of  components  to  environments  beyond  transportation 
levels."  The  shipping  container  (ref.  22)  was  reportedly  shock  tested 
during  the  development  program  in  1964  and  successfully  sustained  the 
test  environment  described  in  reference  23-  From  these  tests  it  was 
concluded  that  the  shock  attenuation  system  in  the  shipping  container 
was  acceptable.  There  was  no  requirement  for  shock  testing  of  the 
oxygen  tank  assembly  outside  its  shipping  container. 


INTERNAL  COMPONENTS 


There  are  a number  of  components  internal  to  the  oxygen  tank. 
These  are  individually  discussed  in  the  following  sections. 


Quantity  Gage 

The  quantity  gage  capacitor  (fig.  D3-12)  consists  of  two  concentric 
aluminum  tubes  which  are  adequately  mounted  and  supported.  The  inner 
tube  of  the  capacitor  constitutes  the  extension  of  the  fill  line.  The 
outer  tube  is  perforated  to  insure  access  of  the  oxygen  to  the  space 
between  the  capacitor  plates.  The  relative  position  of  the  two  plates 
is  maintained  by  insulating  Teflon  separators.  Shorting  of  the  capaci- 
tor at  the  plates  within  the  tank  requires  bridging  of  the  gap  between 
the  tubes  by  a conductive  material.  Shorting  could  also  be  induced  by 
the  contact  of  bare  lead  wires  resulting  from  insulation  damage.  The 
power  input  to  the  quantity  gage  is  regulated  and  limited  by  the  high 
impedance  source  of  the  signal  conditioner.  The  spark  that  could  be 
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Vent  line  and  electrical 


Figure  D3-12*-  Quantity  gage 


generated,  is  at  the  7-  to  10-milli joule  level.  The  evidence  provided 
by  the  data  can  be  construed  to  indicate  that  the  effects  of  the  probe 
failure  during  flight  were  limited  to  data  loss. 


Heaters 

The  two  electrical  heaters  (fig.  D3-13)  are  mounted  to  the  heater 
fan  support  tube.  The  heaters  are  nichrome  resistance  wire  imbedded  in 
magnesium  oxide  insulation  encased  within  a sheath  of  stainless  steel. 

The  stainless  steel  sheath  is  spiralled  and  brazed  to  12.0  inches  of 
the  support  tube  length.  The  specifications  established  by  North 
American  Rockwell  for  the  Block  II  EPS  cryogenic  storage  system  (ref.  24-) 
provide  a requirement  for  operation  of  the  heater  circuit  at  65  V dc  from 
a GSE  source  for  initial  pressurization  of  the  oxygen  tank.  For  flight 
the  specification  calls  for  operation  from  a 28  V dc  source.  The  speci- 
fications established  by  Beech  Aircraft  Corporation  for  the  heater 
(ref.  25)  stipulate  standby  operation  from  an  ac  source,  later  estab- 
lished as  65  V ac,  for  50  minutes.  While  the  heater  is  apparently 
satisfactory  for  its  intended  use,  the  specifications  are  not  compatible 
with  the  intended  use.  The  heater  circuit  is  protected  by  a 15-ampere 
circuit  breaker.  Individual  thermostats  for  each  heater  are  also 
mounted  on  the  inside  of  the  support  tube. 

The  thermostats  were  included  in  the  heater  circuit  to  prevent 
raising  the  pressure  vessel  wall  temperatures  above  90°  F,  the  design 
temperature  for  the  vessel  walls.  Such  a condition  (i.e.,  walls 
reaching  temperature  above  90°  F under  operating  pressure)  might  occur 
if  there  was  a very  low  quantity  of  oxygen  left  in  the  tank  and  it  was 
desired  to  maintain  pressure.  There  is  no  known  instance  of  the  ther- 
mostats ever  having  had  to  operate  in  flight. 

A cross  section  of  a thermostat  is  shown  with  the  contacts  in  the 
open  position  in  figure  D3-14.  The  contacts  would  assume  this  position 
when  the  temperature  of  the  thermostat  reached  80°  ± 10°  F.  When  the 
thermostat  temperature  is  reduced  to  60°  ± 7°  F,  the  differential  con- 
traction of  the  two  metals  of  the  bimetallic  disc  causes  the  disc  to 
snap  through,  assuming  a convex  up  configuration.  This  forces  the  wave 
washer  and  the  attached  thrust  pin  to  move  upward.  The  movable  arm 
containing  the  lower  contact  is  pushed  up  by  the  thrust  pin  and  the 
contacts  are  closed.  The  wave  washer  acts  as  a spring  to  keep  the 
thrust  pin  bearing  against  the  bimetallic  disc.  All  of  the  moving 
parts  of  the  thermostat  are  enclosed  in  an  hermetically  sealed  case. 

The  thermostats  are  rated  by  the  manufacturer  as  follows. 
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CURRENT  RATING  OF  THERMOSTAT 


Number  of  cycles 

Applied 

v 0 1 t a g 

e 

30  V ac  or  dc 

125  v ac 

250  V ac 

100,000 

5.0  amp 

2.0  amp 

1.0  amp 

50,000 

5.5  amp 

3 . 0 amp 

1 . 5 amp 

25,000 

6.0  amp 

4 . 0 amp 

2.0  amp 

10,000 

6.5  amp 

5.0  amp 

2.5  amp 

5,000 

7.0  amp 

6.0  amp 

3.0  amp 

The  specifications  established  by  North  American  Rockwell  for  the 
Block  II  EPS  cryogenic  storage  system  (ref.  24)  provide  a requirement 
for  operation  of  the  heater  circuit  at  65  V dc  from  a GSE  source  for 
initial  pressurization  of  the  oxygen  tank.  For  flight,  the  specifica- 
tion calls  for  operation  from  a 28  V dc  source.  The  specifications 
established  by  Beech  Aircraft  Corporation  for  the  thermostat  (ref.  26) 
stipulate  a current-carrying  requirement  of  7 amperes  without  specifying 
voltage  level  or  type  of  source  (i.e.,  ac  or  dc).  Acceptance  test  re- 
quirements imposed  on  the  supplier  by  this  latter  document  include 
dielectric  testing,  thermal  shock,  verification  of  operating  tempera- 
tures of  the  thermostat,  helium  leak  test,  insulation  resistance  test, 
and  visual  and  dimensional  inspection.  No  requirement  is  imposed  for 
acceptance  test  verification  of  the  operational  characteristics  of  the 
thermostat  with  respect  to  current-carrying  capability  or  ability  to 
open  under  load  at  any  of  the  several  voltages  (65  V dc,  65  V ac,  or 
28  V dc)  to  which  the  thermostat  will  normally  be  subjected. 

Qualification  testing  of  the  thermostats  was  accomplished  as  part 
of  the  overall  testing  of  the  assembled  oxygen  tanks.  These  tests 
included  vibration,  acceleration,  and  mission  simulation.  Operation 
of  the  heater  circuit  at  Beech  during  the  oxygen  tank  qualification 
program  and  for  all  normal  acceptance  testing  is  accomplished  using 
65  V ac  for  initial  pressurization.  Since  this  is  done  only  when  the 
tank  is  filled  with  liquid  oxygen,  it  is  highly  unlikely  that  tempera- 
tures would  be  raised  to  levels  that  would  cause  operation  of  the 
thermostats.  One  instance  of  a single  thermostat  operating  to  open  a 
heater  was  experienced  in  the  First  Mission  Subsystem  Qualification 
Test  (ref.  27).  At  this  time,  heaters  were  being  energized  from  a 
28  V dc  bus. 


Figure  D3-13.-  Heater  fan  support. 


All  qualification  and  acceptance  tests  identified  were  primarily 
concerned  with  the  repeatability  of  the  thermostat  actuation  at  the 
specified  temperatures.  No  qualification  or  acceptance  tests  have  been 
identified  which  would  verify  the  ability  of  the  thermostats  to  open 
the  heater  circuit  when  energized  at  65  V dc. 

The  combination  of  incomplete,  unclear,  and  therefore  inadequate 
specifications  of  the  thermostat  with  respect  to  voltage  type  and  level 
and  a test  program  that  does  not  verify  the  ability  of  the  switch  to 
operate  satisfactorily  under  service  conditions  constitutes  a design 
deficiency.  The  fact  that  the  ratings  for  the  thermostat  by  the  manu- 
facturer (preceding  table)  contains  no  entry  for  65  V dc  indicates  that 
service  at  this  voltage  was  not  intended. 

At  KSC,  the  heater  circuits  were  intended  to  be  operated  at  65  V dc 
only  when  the  tanks  were  full  of  liquid  oxygen.  Under  this  condition, 
the  thermostats  would  not  be  required  to  actuate.  A discussion  of  the 
possible  consequences  of  actuation  of  the  thermostat  under  load  at 
65  V dc  is  presented  in  a later  section  of  this  Appendix. 


Fans 

At  the  time  the  tanks  were  first  designed,  the  knowledge  of  the 
behavior  of  fluids  in  zero-g  was  limited.  It  was  believed  that  signi- 
ficant stratification  of  the  fluid  would  occur  during  flight.  Under 
these  circumstances  a number  of  difficulties  could  arise:  a rapid 

pressure  drop  in  the  tank  would  be  induced  by  the  acceleration  resulting 
from  an  SPS  burn;  the  heaters  might  not  be  able  to  transfer  heat  uni- 
formly to  the  oxygen;  and,  finally,  serious  errors  in  quantity  measure- 
ment could  result.  The  occurrence  of  any  of  these  conditions  could 
jeopardize  flight  safety  or  mission  success.  For  this  reason,  the  tanks 
were  provided  with  two  motor-driven  centrifugal  fans  to  mix  the  fluid 
and  insure  its  homogeneity. 

The  two  oxygen  fan  motors  (fig.  D3-15)  are  three-phase,  four-wire, 
200/115-volt,  400-hertz,  miniature,  open  induction  motors,  driving  cen- 
trifugal flow  impellers.  The  minimum  speed  of  the  motors  is  1800  rev- 
olutions per  minute  at  a torque  output  of  0.9  ounce-inches.  The  motors 
are  mounted  at  each  end  of  the  motor-heater  support  tube  by  a canti- 
levered attachment  joined  to  the  motor  back  plate.  The  motor  clearance 
within  the  support  tube  wall  is  a nominal  0.01  inch.  The  stator  windings 
and  bearings  of  the  motors  are  exposed  to  oxygen. 

The  stator  windings  are  fabricated  with  number  36  American  Wire 
Gage  (AWG)  wire,  using  a Teflon-coated  ceramic  insulation.  The  ceramic 
insulation  is  brittle  and  subject  to  breakage  if  proper  tension  is  not 
used  in  fabricating  windings  or  if  sharp  bends  are  made  at  the  winding 
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Figure  D3-15.-  Oxygen  fan  motor. 


end  turns.  Acceptance  testing  of  the  wire  is  conducted  on  the  first 
100  feet  of  each  reel.  The  wire  is  considered  acceptable  if  no  more 
than  10  breaks  in  insulation  are  exhibited  in  the  sample  when  pulled 
through  mercury  at  25  feet  per  minute.  The  rejection  rate  for  stator 
winding  faults  for  motors  processed  early  in  the  production  run  was 
substantial.  Improved  yield  was  achieved  only  by  rigid  adherence  to 
the  winding  tension  process  control  used  in  fabricating  the  windings, 
proper  assembly  techniques,  and  frequent  in-process  dielectric  testing. 
Phase-to-phase  short  circuits  or  shorted  turns  within  a single  phase 
are  more  likely  than  phase -to-ground  faults.  A limited  amount  of  in- 
sulation is  provided  between  windings  and  ground.  Phase-to-phase  in- 
sulation is  limited  to  the  end  turns.  Considerable  improvement  was 
accomplished  in  the  acceptance  rate  of  motors  built  after  the  fabrica- 
tion control  techniques  were  developed  (Appendix  C).  Wo  problem  was 
exhibited  in  the  testing  of  the  two  motors  finally  installed  for  flight 
in  oxygen  tank  S/N  XTA0008. 

The  motor  design  uses  an  insulation  system  in  the  windings  which 
is  subject  to  failure  unless  carefully  controlled.  The  individual 
power  leads  to  each  fan  motor  are  protected  by  1-ampere  fuses. 

Temperature  Sensor 

The  temperature  sensor  is  a calibrated  resistor,  the  resistance  of 
which  is  proportional  to  temperature.  The  sensor  is  mounted  to  the 
upper  glass-filled  Teflon  fitting  of  the  capacitor  probe.  Since  the 
calibrated  input  to  the  resistor  is  current  limited  to  1.1  milliamperes 
under  fault  conditions  of  the  sensor,  no  problem  would  be  anticipated 
with  this  unit. 


Wiring 

Wire  sizes  and  types  of  wire  used  within  the  oxygen  tank  are  shown 
in  table  D3-IV.  The  insulation  used  in  all  cases  is  Teflon  with  a 
nominal  thickness  of  0.010  inch.  Distribution  and  arrangement  of  the 
wires  is  shown  in  figure  D3- 16. 

The  insulation  on  all  wires  within  the  tank  is  specified  by 
reference  28  to  conform  to  MIL-W-16878,  Type  E.  The  insulation  thick- 
ness requirements  of  this  specification  establish  the  following. 

Insulation  Thickness,  in. 


Condition 

Minimum 

Nominal 

Maximum 

Nominal 

0.008 

0.010 

0.012 

With  out-of-center 
tolerance 

0.007 

0.010 

0.01U 

TABLE  D3-IV.-  WIRES  INSIDE  OXYGEN  TANK 
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Figure  D3-l6.-  Oxygen  tank  wiring  distribution. 


The  mechanical  design  of  the  tank  with  respect  to  provisions  for 
wiring  is  considered  deficient.  Damage  to  the  wiring  may  "be  either 
insulation  damage  or  conductor  damage,  portions  of  which  cannot  "be 
inspected  or  adequately  tested  during  or  after  assembly. 

The  four  number  2 6 AWG  wires  for  the  fan  motors  are  encased  in 
0 . 012- inch-thick  shrink-fit  Teflon  tubing  from  the  motor  housing  to  a 
point  0.3  inch  outside  the  heater- fan  tube.  The  0.012-inch  shrink-fit 
tubing  provides  the  protection  for  the  wires  at  the  point  where  the 
four-wire  bundle  crosses  the  machined  sharp  edges  of  the  access  hole 
in  the  heater  tube  (fig.  D3-17).  The  shrink-fit  tubing  does  not, 
however,  alleviate  the  strain  on  the  90-degree  bend  of  the  wires  at  the 
motor  housing.  During  assembly  of  the  fan  to  the  support  tube,  the 
four-wire  bundle  in  the  shrink-fit  tubing  may  be  forced  against  the 
machined  sharp  edges  of  the  support  tube  at  point  "a"  of  figure  D3-17. 

Two  specimens  of  the  support  tube  that  have  been  examined  show  no  re- 
moval of  burrs  at  this  point.  Between  the  motor  and  the  access  hole  in 
the  support  tube,  the  wire  bundle  is  restrained  by  a 0.010-inch  thick 
soldered  copper  clip. 

The  twisted  lower  fan  motor  leads  (without  shrink-fit  tubing) 
reenter  the  support  tube  and  traverse  a 3/16— inch— diameter  conduit  for 
12.0  inches  before  again  exiting  the  support  tube.  No  specification 
restraint  on  slack  left  in  the  bundle  contained  within  the  heater  tube 
conduit  was  noted.  The  motor  leads  are  in  contact  with  the  conduit,  at 
least  at  the  ends  of  the  conduit,  and  exposed  to  local  heat  conditions 
of  the  heater  elements. 

Design  changes  were  made  between  Block  I and  Block  II  configurations 
to  provide  independent  circuits  to  each  motor  and  heater  within  the 
oxygen  tanks.  Provision  was  made  in  the  glass-filled  Teflon  separator 
on  the  quantity  probe  for  access  of  the  extra  six  wires  to  the  upper  end 
of  the  probe  assembly.  The  conduit  (l/2-inch  0D  x 0.015-inch  wall)  in 
the  dome  for  wiring  to  the  connector  was  not,  however,  increased  in 
size . 


During  assembly  of  the  tank,  three  bundles  of  six  wires  each  are 
sequentially  pulled  through  the  conduit.  The  first  bundle,  consisting 
of  the  two  quantity  gage  wires  and  the  four  temperature  sensor  wires, 
is  pulled  through  the  conduit  along  with  the  pull  wires  for  the  other 
bundles.  The  second  and  third  bundles  each  consist  of  one  set  of  motor 
leads  encased  in  0.012-inch  shrink-fit  tubing  and  one  set  of  heater  leads. 
The  pull  wires  have  a break-strength  of  65  pounds.  Since  the  third  bundle 
of  wire  must  be  forceably  pulled  through  the  conduit,  damage  to  wires  in 
this  bundle  or  the  others  may  result  which  may  not  be  detectable  without 
physical  inspection.  Physical  inspection  cannot  be  accomplished  with  this 
design. 


The  calculated  break  strength  of  a number  26  AWG  nickel  wire  is 
11  pounds  and  elongation  of  28  percent  can  be  experienced  before  break. 
If  the  number  26  AWG  wires  do  not  share  the  load  associated  with  pulling 
the  bundle  through  the  conduit,  damage  to  the  wire(s)  will  result  be- 
fore the  pull  wire  breaks.  Stretching  of  the  wire  results  in  local 
neck— down  of  both  the  conductor  and  insulation.  In  subsequent  operation 
of  the  circuit , the  locally  smaller  gage  conductor  can  produce  local 
hot  spots  and  progressive  deterioration  of  the  insulation. 


Discussion 


All  electrical  power  system  wiring  is  protected  by  fuses  or 
circuit  breakers  specified  on  the  basis  of  wire  size.  Such  devices 
will  transmit  their  rated  current  without  opening  the  circuit  to 
either  the  load  or  a fault.  The  opening  of  the  device  to  protect  the 
circuit  on  overload  is  determined  by  an  inverse  time  to  over-current 
ratio  that  will  open  a large  current  fault  in  a short  time,  and  a smaller 
oyer-current  fault  in  a longer  time.  The  protection  afforded  is  to  the 
wire  and  power  system  rather  than  to  the  connected  end  item. 

The  wiring  in  the  oxygen  tank  has  inherent  potential  for  damage 
in  assembly  due  to  inadequate  support,  inadequate  clearances,  and  thin 
Teflon  insulation.  It  is  well  known  (refs.  29  and  30)  that  Teflon  in- 
sulation cold  flows  when  subject  to  mechanical  stress.  The  design  of 
tank  internal  installation  exposes  the  insulation  to  potential  pro- 
gressive damage  by  cold  flow  where  the  wiring  is  placed  near  or  at  bends 
around  sharp  corners. 


COMPATIBILITY  OF  MATERIALS  WITH  OXYGEN 


It  is  well  known  that  virtually  all  materials  except  oxides  will 
react  with  liquid  oxygen  (LOX)  under  specific  conditions.  The  tend- 
encies to  react  and  the  rates  of  reaction  vary  widely.  Most  organic 
materials  and  the  more  active  metals  are  sufficiently  reactive  with 
LOX  to  require  careful  attention  to  the  condition  under  which  they  are 
used.  Spontaneous  reaction  does  not  usually  occur  upon  contact  between 
a material  and  LOX;  however,  the  sudden  application  of  energy  in  the 
form  of  mechanical  shock  or  electrical  spark  to  the  combination  of  LOX 
and  a chemically  active  material  will  often  result  in  violent  reaction 
or  rapid  burning. 
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Classification  Methods 


A method  commonly  used  to  classify  the  relative  reactivity  of 
materials  with  LOX  is  described  in  references  31  and  32.  Based  upon 
this  method,  a specification,  MSFC  specification  106b,  "Testing  Com- 
patibility of  Materials  for  Liquid  Oxygen  Systems,"  was  developed  to 
establish  acceptance  criteria  of  materials  for  use  in  LOX  and  gaseous 
oxygen  (GOX)  systems.  Materials  meeting  the  requirements  of  paragraph 
3*3  of  the  specification  are  said  to  be  compatible  with  LOX.  In  this 
context  it  must  be  recognized  that  the  term  "compatible"  describes  only 
the  relative  reactivity  of  a material  and  does  not  describe  an  absolute 
situation. 

Materials  for  use  with  LOX  are  selected  from  the  "compatible"  list 
of  references  33  to  36  under  the  additional  stipulation  that  the  level 
of  any  potential  mechanical  shock  is  less  than  that  associated  with  the 
impact  test  and/or  that  potential  electrical  energy  sources  are  less 
than  the  ignition  energy  of  the  material  in  LOX.  If  a material  is  used 
with  oxygen  and  a potential  energy  source,  it  must  be  determined  by 
test  that  the  energy  available  is  less  than  that  required  to  initiate 
the  reaction.  Furthermore,  the  test  should  represent  the  circumstances 
of  use  as  nearly  as  possible. 

For  example,  the  pressures  and  temperatures  of  the  oxygen  to  which 
the  material  will  be  exposed  should  be  duplicated  in  the  tests.  Ad- 
ditionally, thickness  and  surface  area  of  the  material,  as  well  as  that 
of  any  backing  material  (such  as  may  act  as  a heat  sink,  for  example) 
should  be  duplicated.  The  latter  is  important  because  there  are  ex- 
amples of  materials  changing  from  an  acceptable  rating  to  an  unaccept- 
able rating  solely  because  of  a change  in  the  thickness  used  in  a par- 
ticular application.  For  some  proprietary  materials  and  composites 
whose  composition  may  vary  from  batch  to  batch,  it  is  necessary  to  re- 
peat the  compatibility  tests  for  each  batch.  Elastomers  are  a good  ex- 
ample of  the  latter  category.  In  summary,  the  methodology  for  determin- 
ing compatibility  must  be  adhered  to  scrupulously  to  preclude  self- 
deception. 


Materials  Internal  to  the  Tank 

The  materials  of  the  internal  components  of  the  oxygen  pressure 
vessel  have  been  identified  from  the  records  (ref.  37)  and  assessed  as 
to  suitability  for  use  in  the  high-pressure  oxygen  environment.  The 
types  and  estimated  quantities  of  materials  in  each  of  these  components 
within  the  oxygen  tank  are  listed  in  tables  D3-V  through  D3-IX. 

Of  the  materials  used  in  the  tank,  most  have  been  subjected  previ- 
ously to  compatibility  testing  in  LOX  in  accordance  with  the  methodology 
of  references  31  and  32. 


TABLE  D3-V.-  MATERIALS  IN  HEATER  ASSEMBLY 


Part  name 

Material 

Estimated 
weight,  lb 

Tube  assembly 

321  stainless  steel 

1.39 

Upper  and  lower 
motor  support 

302  stainless  steel 

.26 

Silver  braze 

QQ-S-561,  Class  II 

.062 

Wire  clamp 

Tinned  copper 

.001 

Thermostat  doubler 

QQ-A-327  (T6)  aluminum  alloy 

-=f 

O 

O 

Grommet 

Teflon  (MIL-P-19462) 

Negligible 

Shim 

321  stainless  steel 

.06 

Bolts 

302  stainless  steel 

.03 

Screws 

302  or  303  stainless  steel 

.ok 

Screws 

302  or  30U  stainless  steel 

.02 

Nuts 

Silver-plated  303  stainless 
steel 

.002 

Washers 

321  stainless  steel 

.02 

Washers 

302  stainless  steel 

.007 

Rivets 

2117  aluminum 

.001 

Safety  wire 

30k  stainless  steel 

Negligible 

Heat  shrinkable  tubing 

Teflon  (TFE) 

AWG  no.  1^4  clear 
AWG  no.  Ik  white 

.001 

.001 

Solder 

QQ-S-571,  type  AR 
Comp  Sn  60-PbU0 

Negligible 

Screw 

Stainless  steel  pw  QQ-S-763 

.01+ 
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TABLE  D3-V . - Concluded 


Part  name 

Material 

Estimated 
weight,  lb 

Clamp 

Stainless  steel  clamp  with 
teflon  cushion 

Negligible 

Drilube  822 

Negligible 

Wire 

AWG  no.  20,  silver-plated 
copper 

0.0278 

Wire  insulation  and 
shrink  fit  tubing 

Teflon 

.0278 

Disk  blank* 

Bi-metal  (21  percent  Ni 
7 percent  Cr  Balance  Fe 
and  3 6 percent  Sn) 

Negligible 

Stationary  contact* 

0.010  fine  silver  on  monel 

Negligible 

Movable  arm* 

0.00U  Permanickel 

Negligible 

Welding  cap* 

Monel 

Negligible 

Insulator* 

Alsimag  6b 5 or  Duco  9F“l6 

Negligible 

Thrust  pin* 

Alsimag  35 

Negligible 

Mounting  bracket* 

302  stainless  steel 

Negligible 

Wave  washer* 

Stainless  steel 

Negligible 

Cup* 

321  stainless  steel 

Negligible 

Rivet  contact* 
(movable ) 

Fine  silver 

Negligible 

Base  assembly* 

321  stainless  steel  base 

Negligible 

*Thermostat  parts 
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TABLE  D3-VI.-  MATERIALS  IN  DENSITY  SENSOR  PROBE 


Part  name 


Density  sensor/assembly 


Bracket 


Spacer 


Rivet 


Rivet,  solid 


Grommet 


Grommet 


Sleeve 


Spacer 


Solder 


Inner  tube  plug 


Rivet-semi-tubular 


Outer  tube 


Eyelet 


Rivet 


Terminal 


Rivet , solid 


Solder 


Sleeve,  insulator  top 


Material 


3003  A1  alloy 

25 $ glass-filled  TFE  Teflon 
1100-H-lU  A1  alloy 
2117,  1100  A1  alloy 


Glass-filled  Teflon 


Glass-filled  Teflon 

Red  tubing  - TFE  Teflon 
Size  9 thin  wall 

25$  glass-filled  Teflon 

Tin/Lead  60/1+0 

25$  glass-filled  Teflon 

1100-H-lU  A1  alloy 

6063-T832  A1  alloy 

Brass  Comp  22  HD  QQ-B-626 

1100-H-11+  A1  alloy 

Brass  l/2-H  Comp. 

1-QQ-B-613B 

110-H-11+  or  2117  A1  alloy 

QQ-S-571  (6o/4o) 

Glass-filled  TFE  Teflon  (25$) 
1100-H-lU  A1  alloy 


Estimated 
weight , lb 
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TABLE  D3-VI.-  Concluded 


Estimated 
weight,  lb 


Part  name 

Sleeve  support  bottom 
Insulator  sleeve  bottom 
Rivet 

Inner  tube 
Terminal  coax 
Wire 

Wire,  insulation  and 
shrink  fit  tubing 


Material 

AMS-5542  Inconel  X annealed 
Fiber-filled  TFE  Teflon 
1100-H-lU  A1  alloy 
6063-T832  A1  alloy 
Brass  1/2-H  Comp  1-QQ-B-613B 
AWG  no.  20,  nickel,  grade  A 
Teflon 
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TABLE  D3-VII MATERIALS  IN  DENSITY  SENSOR  PROBE  TUBE  ASSEMBLY 


Estimated 

Part  Name 

Material 

weight,  lb 

Tube  assembly 

Inconel  X750 

1.35 

Sleeve  connector 

Inconel  X750 

.1 

Electrical  connector 

Inconel  X750 

• 25 

Solder  terminals 

Gold-plated  Inconel  X750 

.001 

Tube 

Inconel  X750 

.005 

Adapter  (fill)  upper 

Teflon  (TFE) 

.016 

Adapter  (fill)  lover 

Teflon  (TFE) 

VO 

rH 

O 

TABLE  D3-VIII.-  MATERIALS  IN  FAN  MOTORS 


Part  name 

Material 

Estimated 
weight , lb 

Screw 

18-8  stainless  steel 

0.02 

Plate,  end 

202U-T1+  A1  alloy 

.OH 

Shim 

302  stainless  steel 

.02 

Shim 

302  stainless  steel 

.02 

Shim 

302  stainless  steel 

.02 

Bushing,  hearing 

303  stainless  steel 

.0U 

Bearing , hall 

UUOC  & Rulon  "A" 

.02 

Bearing,  hall 

Ui+OC  & Rulon  "A" 

.02 

Spacer  sleeve 

303  stainless  steel 

.10 

Lamination 

Ludnum  A1-4750-H  no.  2 
temp.  RL  fin. 

.02 

Insulator,  stator  slot 

Teflon  impreg.  glass  cloth 

.02 

Insulator,  cell  cover 

Teflon  impreg.  glass  cloth 

.02 

Terminal 

Brass  1/2-H  QQ-B-613 

.02 

Sleeving,  heat 
shrinkable 

Teflon  TFE 

.02 

Compound,  insulating 

Liquinite  Teflon  FBC  powder 

.02 

Wire , magnet 

Teflon  overcoated  ceramic 
insulation  over  copper  wire 

.2 

Housing 

2024-TU  A1  alloy 

.2 

Ring  yoke 

Transformer  grade  A silicon 
electrical  steel 

.02 
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TABLE  D 3- VIII.-  Concluded 


Part  name 

Material 

Estimated  ' 
weight , lb 

Retainer  stator 

202b-Tk  A1  alloy 

0.02 

Plate,  bearing 

303  stainless  steel 

.16 

Pin,  spring 

302  stainless  steel 

.02 

Pin,  spring 

302  stainless  steel 

.02 

Insulator 

Teflon 

.02 

Grommet 

Teflon 

.02 

Strain  relief 

Teflon  impreg.  glass  cloth 

.02 

Sleeve,  rotor 

Ul6  stainless  steel  QQ-5-763 

.02 

Shim,  cover 

302  stainless  steel 

.02 

Plate,  front 

3003  aluminum  alloy 

.02 

Vane , impeller 

No.  12  brazing  sheet 

.02 

Plate,  back 

No.  12  brazing  sheet 

.02 

Hub 

1100-F  aluminum 

.02 

Lubricant 

Drilube  no.  822 

.002 

Safety  wire 

300  series  stainless  steel 

Negligible 

Wire 

AWG  no.  2 6,  nickel,  grade  A 

.0327 

Wire  insulation  and 
shrink  fit  tubing 

Teflon 

.0518 

TABLE  D3-IX. - MATERIALS  IN  FILTER 


Part  Name 

Material 

Estimated 
weight,  lb 

Body 

Inconel  X750 

0.016 

Nut 

30k  stainless  steel 

0 

0 

CT\ 

Washer 

30h  stainless  steel 

.002 

Disc 

302  stainless  steel 

.021 

Seal 

Teflon 

.008 
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Some  of  the  materials  in  the  tables,  however,  have  a questionable 
compatibility  with  LOX,  under  the  criteria  of  MSFC  specification  106b. 
These  are  the  following: 

60-percent  tin,  40-percent  lead  solder 

Teflon  (TFE)  heat  shrinkable  tubing 

Drilube  822 

Rulon  A 

Colored  Teflon 

Teflon  liquinite  powder 

The  solder  is  listed  as  incompatible  in  the  references  33  to  36.  There 
are  no  test  results  for  heat  shrinkable  Teflon  tubing  in  the  references. 
The  last  four  materials  have  given  inconsistent  results  in  compatibility 
tests  and  exemplify  the  "batch"  problem  previously  discussed.  In  ad- 
dition to  the  above,  some  of  the  materials  within  the  sealed  thermostats 
(table  D3-V)  have  apparently  not  been  tested. 

It  must  be  emphasized  that  the  data  in  the  references  cited  are  for 
tests  in  LOX  at  relatively  low  pressures.  The  compatibility  of  the  ma- 
terials under  the  conditions  of  service  in  the  tank  is  thus  not  neces- 
sarily characterized  by  the  referenced  data. 

The  Teflon  insulation  used  on  the  wiring  within  the  tank  is  a prime 
suspect  substance  that  burned  inside  Apollo  oxygen  tank  no.  2 (Appen- 
dix F).  Over  many  years  of  use,  Teflon  has  been  proven  to  be  one  of  the 
most  satisfactory  nonmetallic  materials  for  use  in  LOX.  It  will  not 
react  with  LOX  unless  excited  by  energy  sources  such  as  extremely  high 
impact  energy  (above  10  Kg-M)  or  a spark.  Adiabatic  compression  tests 
up  to  pressure  of  the  order  of  10  to  12  ksi  have  failed  to  ignite  Tef- 
lon. However,  additives  to  Teflon  to  produce  color  or  other  property 
changes  have  been  known  to  increase  the  susceptibility  of  Teflon  to 
react  with  LOX. 

It  must  be  noted  that  all  oxygen  compatibility  tests  are  conducted 
with  the  specimens  in  a scrupulously  "LOX-clean"  condition.  Cleanliness 
of  materials  within  oxygen  systems  is  vital.  Something  as  innocuous  as 
the  oils  from  a fingerprint  can  serve  as  the  starting  point  for  a chain 
of  chemical  reactions  that  can  lead  to  a catastrophic  failure.  For 
this  reason,  the  same  standards  of  cleanliness  employed  in  compatibility 
tests  must  be  applied  to  flight  systems. 

Although  the  quantities  of  incompatible  materials  may  be  small, 
these  materials  can  provide  the  mechanism  for  initiating  other  reactions. 
For  example,  in  a recent  test  at  MSC,  2 grams  of  Teflon  were  ignited  in 
900  psi  oxygen,  temperature  -190°  F,  by  means  of  a hot  wire.  This,  in 
turn,  ignited  a piece  of  aluminum  0.006  inch  by  0.75  inch  by  0.75  inch 
that  was  in  contact  with  the  Teflon. 


Titanium  is  not  listed  as  a material  used  in  the  oxygen  system; 
however,  a titanium  clamp  of  the  same  drawing  number,  distinguished  only 
by  a different  dash  number,  is  used  in  the  hydrogen  tank.  The  clamp  is 
made  in  two  halves.  The  identifying  number  is  stamped  on  only  one  half. 
The  titanium  halves  are  matched,  drilled,  and  bagged  together  at  the 
manufacturers.  If  a half  clamp  made  of  titanium  had  been  placed  in- 
advertently in  the  oxygen  tank,  it  could  have  contributed  to  the  fire 
and  subsequent  tank  failure  as  the  clamp  is  attached  to  the  boss  area 
of  the  tank.  Because  of  the  bagging  and  other  controls,  it  is  unlikely 
that  a titanium  clamp  found  its  way  into  an  oxygen  tank.  It  is  poor 
design  practice,  however,  to  have  dimensionally  identical  parts  of 
different  materials  that  may  be  interchanged  and  then  installed  in  a 
potentially  hostile  environment. 

Although  not  normally  exposed  to  supercritical  oxygen,  the  alum- 
inized Mylar  used  in  the  oxygen  tank  vacuum  annulus,  and  within  the  SM, 
is  of  interest  in  the  investigation.  Aluminized  Mylar  is  not  compatible 

oxygen  and  were  the  pressure  vessel  or  the  tank  internal  tubing  to 
fail,  the  Mylar  in  the  annulus  and/or  the  SM  would  be  exposed  to  con- 
centrated oxygen.  If  an  ignition  source  is  present,  the  Mylar  would 
burn.  If  such  burning  were  to  have  occured  within  bay  4,  it  could  have 
contributed  to  pressurization  of  the  bay  and  consequent  loss  of  the  SM 
panel. 


OTHER  DESIGN  AND  SYSTEM  CONSIDERATIONS 


A number  of  other  features  and  components  of  the  oxygen  tank  system 
and  of  other  spacecraft  systems  are  discussed  in  the  following  sections. 


Oxygen  System  Relief  Valves 

The  oxygen  tank  relief  valve  was  designed  to  protect  the  oxygen 
tank  against  the  effects  of  potential  malfunctions  of  the  tank  subsystem. 
Specifically,  the  valve  was  designed  to  relieve  a pressure  build-up 
resulting  from  the  worst  of  the  following  three  system  malfunction  con- 
ditions : 


1.  Heaters  on  GSE  power  supply  at  ground-rated  conditions  with  a 
full  tank  and  fans  running  with  thermostats  failing  to  open.  This  yields 
a heat  input  of  3002  Btu/hr , which  would  require  a valve  flow  of  18  lb /hr 
to  prevent  exceeding  1010  psig. 

2.  Heaters  on  at  spacecraft  voltage  level  (28  V dc)  and  fans 
running  with  tank  filled  such  that  minimum  dQ/dm  exists  (i.e.,  most 
critical  condition  for  raising  pressure).  This  yields  a heat  input  of 
685  Btu/hr  and  a valve  flow  requirement  of  19  lb/hr. 
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3.  Loss  of  vacuum  in  the  annulus  with  the  tank  filled  such  that 
minimum  dQ/dm  exists.  This  yields  a heat  input  of  935  Btu/hr  which 
requires  a valve  flow  capacity  of  2 6 lb /hr. 

The  third  condition  requires  the  largest  relief  valve  flow  capacity 
and  this  was  used  to  size  the  valve.  It  was  also  stipulated  that  the 
valve  must  pass  this  flow  with  the  fluid  at  +130°  F.  These  criteria 
were  considered  conservative  because  of  the  effects  of  flow  through  the 
relief  valve  on  the  heat  leak?  dQ/dm,  and  system  temperatures. 

A question  arises  from  an  examination  of  the  three  malfunction  con- 
ditions assumed:  Why  was  the  case  of  heaters  powered  by  ground  support 

equipment  (GSE)  at  critical  dQ/dm  not  considered?  Under  such  a circum- 
stance, the  heat  input  would  be  approximately  U-l/2  times  that  of 
condition  2 with  a flow  requirement  increase  in  the  same  proportion.  It 
was  determined  that  it  was  not  intended  to  ever  use  GSE  power  to  the 
heaters  except  when  the  tank  was  full. 

The  design  philosophy  of  the  relief  valve  thus  contemplated  single- 
failure modes  associated  with  anticipated  malfunctions.  It  did  not 
contemplate  a catastrophic  failure  mode  such  as  would  be  produced  by 
combustion  within  the  tank.  This  is  not  an  uncommon  design  practice  in 
the  sizing  of  relief  valves.  In  ground  systems,  however,  in  addition  to 
relief  valves,  pressure  vessels  are  frequently  provided  with  large  burst 
discs  or  blowout  patches  to  protect  against  pressure  rises  that  would 
result  from  conditions  other  than  anticipated  malfunctions. 

The  Block  II  relief  valve  was  subjected  to  qualification  testing 
as  part  of  an  oxygen  system  valve  module  qualification  test  program 
conducted  by  Parker  Aircraft  Company  for  North  American  Rockwell  (NR) 
in  March  of  1967*  Reference  38  describes  the  test  program  and  the  results. 
Briefly,  the  module,  consisting  of  check  valve  (for  no.  2 tank),  relief 
valve,  pressure  switch,  and  pressure  transducer,  was  subjected  to  the 
following  tests:  performance,  vacuum,  vibration,  acceleration,  humidity, 

and  endurance  cycling.  Random  vibration  excitation  was  applied  for 
15  minutes  for  each  axis.  The  acceleration  testing  was  for  5 minutes  in 
each  of  the  +X,  -X,  +Y  and  +Z  axes.  During  both  vibration  and  acceleration 
tests,  the  various  module  elements  were  operated.  The  pressurizing  medium 
was  nitrogen  at  room  temperature  during  all  tests,  except  for  one  of  the 
endurance  tests  which  was  conducted  at  -230°  F. 

The  only  discrepancy  recorded  for  the  test  program  was  out-of- 
specification leakage  of  the  check  valve  subsequent  to  the  vibration  test- 
ing. This  was  ascribed  to  the  fact  that  fluid  was  not  flowing  through 
this  normally  open  check  valve  during  vibration  which  would  be  its  con- 
dition during  flight.  This  absence  of  fluid  permitted  the  valve  poppet  to 
repeatedly  strike  the  seat  causing  abnormal  wear.  Further,  there  was 
contamination  present  in  the  valve  from  the  flex  line  used  in  the  test 
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setup.  This  aggravated  the  problem.  Because  these  factors  were  present, 
the  test  conditions  were  considered  not  representative  of  actual  service 
conditions  and  the  check  valve  performance  was  considered  acceptable 
(ref.  39).  It  should  be  noted  that  the  Block  I valve  was  tested  using 
oxygen  as  the  fluid  medium  and  that  the  changes  from  Block  I to  Block  II 
valves  were  such  as  to  not  invalidate  the  materials  compatibility  demon- 
strated with  the  Block  I systems. 

A number  of  observations  are  warranted.  No  shock  testing  was  required 
for  the  qualification  of  the  relief  valve.  In  view  of  the  fact  that  other 
valves  in  the  service  module  exhibited  shock  sensitivity  during  the 
Apollo  13  flight  and  the  fact  that  only  a few  thousands  of  an  inch  of 
poppet  travel  is  required  to  open  the  relief  valve  fully , it  would  be 
valuable  to  determine  whether  the  relief  valve  is  sensitive  to  shock. 

It  is  possible  that  the  relatively  slow  decay  of  oxygen  tank  no.  1 
subsequent  to  the  accident  might  be  the  result  of  a relief  valve  that 
failed  to  seat  correctly  after  the  shock. 

In  the  qualification  program  there  was  no  requirement  for  the  relief 
valve  to  vent  or  relieve  into  a hard  vacuum  as  it  would  have  to  in  space. 

It  is  possible  that  under  such  conditions  the  oxygen  would  cool  enough 
to  solidify,  thus  plugging  the  orifice-like  passage  of  the  valve  or  the 
downstream  lines  that  lead  to  the  overboard  exit,  precluding  further 
relieving  by  the  valve.  This  is  particularly  important  because  the  exit 
lines  from  both  relief  valves  are  manifolded  prior  to  entering  the 
overboard  line.  Were  the  common  line  to  be  plugged  by  solid  oxygen  by 
flow  from  one  valve,  it  might  prevent  the  second  valve  from  relieving 
should  it  be  required  to  do  so.  An  experiment  would  be  required  to 
verify  this. 


Arrangement  at  Head  of  Tank 

The  head  ends  of  the  tank  and  the  temperature  sensor  and  quantity 
probe  are  shown  in  figure  D3-18.  One  of  the  more  significant  features 
of  the  design  is  the  arrangement  of  the  connections  in  the  fill  line 
which  routes  the  cryogenic  fluid  to  the  bottom  of  the  tank,  via  the 
inner  element  of  the  quantity  gage  capacitor,  and  which  permit  the 
fluid  to  flow  from  the  bottom  of  the  tank  during  ground  detanking.  The 
manufacturing  drawings  of  the  elements  of  this  connection,  two  Teflon 
adapters  and  an  Inconel  tube,  allow  a tolerance  stack  which  is  excessive. 
One  combined  worst  case  results  in  a connection  which  cannot  reach  from 
the  fill  tube  connection  in  the  tank  head  to  the  center  element  of  the 
quantity  gage  capacitor.  The  other  results  in  a connection  length  which 
prevents  assembly  of  the  probe  to  the  adapter  in  the  head  of  the  tank. 
These  are  shown  in  figure  D3-19-  The  tolerances  on  concentricity  between 
the  inner  element  of  the  capacitor  and  the  outer  shell  of  the  probe  are 
not  known  and  are  omitted  from  this  figure.  Inclusion  would  show  an  even 
worse  situation  than  shown. 
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Vent  line  and  electrical 
conduit  also  pass 
through  this  adapter 


Adapter  cap  inconel 


Teflon  adapter 

Inconel  tube 
Teflon  adapter 


Inconel 


Temperature  sensor 
and  quantity  probe 

Tubular  elements  of 
capacitor  (aluminum) 


.224 


.232 
places  for  heater 
and  motor  wiring 


dia  holes/  two 


Hole  for  temperature 
sensor  wiring 


Glass-filled 
teflon  insulator 

T emperature 
sensor  element 
is  mounted  on 
this  insulator 


Figure  D3-18*-  Arrangement  of  head  end  of  tank. 
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Figure  D3-19*-  Possible  variations  in  fill  line  connection. 


The  experience  with  the  oxygen  tank  no.  2 in  Apollo  1J  (apparently 
normal  detanking  at  Beech,  but  normal  detanking  not  possible  at  KSC) 
suggests  that  the  components  used  in  the  fill  line  connection  were  close 
to  a worst-case  short  situation.  Tests  conducted  recently  at  Beech  show 
that  near  normal  detanking  is  possible  when  considerable  leakage  is 
present  at  the  joints  in  the  connection,  and  that  a substantial  dis- 
placement of  the  top  Teflon  adapter  relative  to  the  fill  line  in  the  tank 
adapter  cap  is  necessary  to  reproduce  the  KSC  situation. 

The  manufacturing  drawing  tolerances  are  such  that  parts  conforming 
to  the  drawings  could  result  in  an  assembly  which  will  not  provide  the 
proper  connection.  However,  the  probability  of  a combined  worst  case  is 
extremely  low.  It  is  probable  that  the  actual  variations  between  pro- 
duction parts  are  significantly  less  than  the  drawing  tolerances  would 
permit,  particularly  the  variations  between  parts  within  a common  batch. 
Data  have  been  requested  on  other  similar  parts  to  determine  whether  the 
variations  from  part  to  part  are  large  or  small,  and  whether  the  average 
tolerance  stack  found  in  practice  leads  to  long  or  short  connection 
assemblies . 

The  design  is  such  that  the  task  of  assembling  the  probe  to  the 
adapter  in  the  head  of  the  tank  (the  connection  is  by  four  tack  welds ) 
is  extremely  difficult.  All  wiring  must  be  loosely  installed,  and  the 
majority  of  this  originates  from  the  fan/heater  assembly  which  must  be 
already  installed  within  the  tank  shell.  The  fill  line  connection  must 
be  steered  into  place  simultaneously  with  the  insertion  of  the  probe 
into  the  adapter,  and  this  becomes  a blind  operation,  complicated  by  the 
fact  that  thermal  expansion  coefficients  dictate  very  sloppy  fits  between 
the  Teflon  adapters  and  the  metal  components  of  the  fill  line.  This 
problem  is  dealt  with  at  greater  length  in  Appendix  C. 

One  way  to  obviate  this  problem  would  be  to  redesign  the  internal 
components  of  the  tank  to  permit  bench  assembly  and  thorough  inspection 
of  a single  assembly,  embodying  all  internal  components  and  their  plumbing 
and  wiring,  before  introduction  into  the  tank  body.  It  is  recognized 
that  a redesign  of  this  magnitude  would  largely  destroy  the  foundation 
of  experience,  both  ground  and  flight,  with  respect  to  the  operational 
characteristics  of  the  tank,  but  it  is  difficult  to  see  how  the  internal 
details  of  the  tank  could  be  modified  to  provide  the  necessary  degree 
of  post-manufacturing  inspectability  without  abandoning  the  present  side- 
by-side  arrangement  of  quantity  probe  and  heater. 


Dome  Assembly 

The  tank  dome  assembly  (fig.  D3-20)  forms  a portion  of  the  outer 
shell  of  the  tank  and  houses  the  fluid  lines  and  electrical  conduit  connec- 
ting the  inner  shell  to  the  exterior  of  the  tank.  The  upper  surface  of 


Dome  assembly 


the  dome  contains  the  upper  pinch-off  tube,  through  which  the  annulus 
is  evacuated,  and  a burst  disc  (rated  at  75  psi  ± 7*5  psi ) that  provides 
burst  protection  for  the  outer  shell  in  the  event  of  leakage  from  the 
inner  shell  into  the  annulus.  The  arrangement  of  the  fluid  lines  and 
electrical  conduit  within  the  dome  is  shewn  in  figures  D3-21  and  D3-22. 
The  coiling  of  these  lines  provides  the  high  impedance  path  for  heat 
leaks  between  the  inner  and  outer  shells  of  the  tank.  In  the  case  of 
the  large  diameter  vent  line,  this  path  is  made  longer  by  use  of  a 
do  lib  le-w ailed  tube  outside  the  dome,  with  connection  between  inner  and 
outer  walls  at  the  extremity  of  the  projection  of  the  tube  from  the 
tank. 


Tube  sizes  are  listed  as  follows  (all  dimensions  in  inches): 


Oxygen  Tank  Tube  Sizing 


Vent  tube 

1/2  OD  x 0.015  wall 
(inside  coil  cover) 

3 A OD  x 0.028  wall 
(outside  coil  cover) 
Inconel  750  AMS  5582 

Fill  tube 

3/8  0D  x 0.022  wall 
Inconel  750  AMS  5582 

Feed  tube* 

1/k  OD  x 0.015  wall 
Inconel  750  AMS  5582 

Electrical  tube 

1/2  0D  x 0.015  wall 
Inconel  750  AMS  5582 

V apor- coole  d* 
shield  tube 

3/16  0D  x 0.015  wall 
Inconel  750  AMS  5582 

Pressure  vessel  to  vapor* 
cooled-shield  tube 

1/4  0D  x 0.015  wall 
Inconel  750  AMS  5582 

*These  three  tubes  are  joined  sequentially  to  provide  a single 
feed  line  which  is  looped  around  the  tank  inner  shell  to  provide 
regenerative  cooling  for  the  vessel. 

A total,  of  18  wires  pass  through  the  electrical  conduit,  eight  AWG 
no.  26’s,  four  AWG  no.  22's,  and  six  AWG  no.  20's.  The  conduit  is  shown 
in  figure  D3-23.  At  the  start  of  the  investigation  some  members  of 
the  Panel  felt  that  the  unorthodox  detanking  procedure  used  at  KSC  could 
have  resulted  in  unacceptably  high  temperatures  in  this  electrical 
conduit  due  to  resistive  heating  of  the  heater  wires.  This  possibility 
is  discussed  in  a later  section. 
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Figure  D3-21.-  Arrangement  of  tubing  within  tank  dome  assembly. 
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Figure  D3-22.-  Arrangement  of  tubing  within  tank  dome  assembly. 


The  design  of  this  portion  of  the  tank  results  in  a configuration 
in  which  it  is  not  possible  to  perform  visual  inspection  of  wiring  after 
assembly.  In  consequence,  the  possibility  of  damage,  in  many  cases  un- 
detectable by  normal  quality  assurance  procedures,  is  significant. 


Filter 

The  filter,  which  is  welded  onto  the  supply  line  projection  into  the 
tank,  is  located  within  the  top  of  the  quantity  gage  adapter  when  the 
tank  is  assembled.  It  consists  of  a series  of  thin  washers  stacked  on 
a tube-like  mandrel  containing  relatively  large  holes  communicating  with 
the  interior  of  the  tube.  The  washers  have  a series  of  raised  projections 
on  one  surface  arranged  in  concentric  circles.  The  projections  in  each 
circle  are  staggered  with  respect  to  those  adjacent  circles.  When  stacked 
on  the  mandrel,  the  spacing  between  the  washers  provided  by  the  projections 
present  a tortuous  path  for  the  fluid  to  traverse  in  order  to  enter  the 
center  of  the  mandrel  and  thus  provides  a filtering  action.  The  filter 
is  rated  at  175  microns  and  is  intended  to  prevent  particles  greater  than 
this  size  from  entering  the  feed  line. 

The  filter  is  of  simple  and  reliable  construction,  and  should  provide 
only  very  small  restriction  to  flow  out  of  the  tank.  In  the  application, 
the  two  components  protected  by  the  filter  are  the  relief  valve  and  the 
check  valve  in  the  tank  no.  2 valve  module,  both  of  which  have  moving 
poppets  that  must  seat  properly  in  order  not  to  leak. 

In  normal  circumstances  the  filter  location  is  appropriate.  Under 
abnormal  circumstances,  such  as  the  combustion  in  tank  no.  2 experienced 
on  Apollo  13,  the  filter  might  become  clogged  with  solid  combustion 
products  and  thus  preclude  flow  to  the  relief  valves.  Considering  its 
construction,  and  ample  flow  area,  this  is  not  very  probable.  Tests  are 
to  be  conducted  to  verify  this. 


Caution  and  Warning  Provisions 

Because  of  their  design,  the  caution  and  warning  system  and  the 
switch-controlled  indicators  ( "talkbacks " ) did  not  present  correct 
systems  status  to  the  crew  during  the  Apollo  13  accident.  As  described 
in  Appendix  B,  the  following  items  are  noted  as  examples: 

1.  The  loss  of  oxygen  to  fuel  cells  1 and  3 occasioned  by  closure 
of  the  oxygen  shutoff  valves  was  not  indicated.  The  series  logic  used 
in  the  information  system  required  that  both  the  hydrogen  shutoff  valve 
and  the  oxygen  shutoff  valve  be  closed  to  activate  the  warning  system. 
Simultaneous  operation  of  the  valves  is  appropriate  to  a deliberate 
shutdown  of  a fuel  cell  which  should  require  no  warning  indication. 
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2.  The  crew  was  not  alerted  to  the  abnormal  rise  and  subsequent 
loss  of  oxygen  pressure  in  tank  no.  2 because  a normal  out-of-limits 
operational  signal  (low  hydrogen  pressure)  was  in  existence. 

3.  When  power  was  lost  to  main  bus  B,  the  "talkback"  indicators 
designed  to  indicate  the  state  of  RCS  valves  were  no  longer  energized 
and  could  not  properly  indicate  valve  position. 

Thus , accurate  information  as  to  the  state  of  spacecraft  systems, 
which  is  vital  in  time  of  emergency,  was  not  provided  by  the  caution 
and  warning  system. 


ABNORMAL  EVENTS  IN  THE  HISTORY  OF  THE  OXYGEN  TANK 


The  oxygen  tank  which  failed  during  the  Apollo  13  mission  had  been 
subjected  to  two  abnormal  incidents  prior  to  launch.  The  first  occurred 
during  spacecraft  assembly.  The  oxygen  shelf  was  "dropped"  and  the 
tank  subjected  to  a shock  load.  The  second  abnormal  condition  occurred 
at  KSG . An  unorthodox  detanking  technique  was  used  when  the  tank  failed 
to  empty  during  the  normal  procedures.  The  possible  consequences  of 
those  incidents  are  discussed  in  the  following  sections. 


Oxygen  "Shelf  Drop"  Incident 

The  oxygen  shelf  which  flew  in  Apollo  13  (Spacecraft  109 ) orig- 
inally was  installed  in  Spacecraft  106.  On  October  21,  1968,  this  shelf 
was  in  process  of  being  removed  from  Spacecraft  106  for  a rework  of  the 
vac-ion  pumps.  During  the  removal,  the  sling  adapter  (ground  equipment) 
broke.  The  cause  for  the  failure  was  traced  to  failure  to  remove  one  of 
the  bolts  attaching  the  shelf  to  the  service  module.  At  the  time  of  the 
incident,  it  was  assumed  that  the  failure  permitted  the  shelf  outboard 
edge  to  fall  back  about  2 inches,  at  which  point  the  shelf  motion  was 
stopped  by  the  supports  in  the  service  module.  An  analysis  of  the  stiff- 
ness of  the  oxygen  shelf  led  to  the  prediction  of  a shock  load  of  the 
order  of  lOg,  The  incident  is  reported  in  more  detail  in  Appendix  C.  An 
analysis  of  the  incident  is  contained  in  the  files  of  the  Board.  The 
general  conclusions  are  as  follows: 

1.  The  Apollo  13  oxygen  "shelf  drop"  incident  can  be  explained  by 
assuming  that  the  counterbalance  weights  on  the  9EH-1275-100  sling  were 
run  out  in  an  attempt  to  "balance"  the  effect  of  the  shelf  attach  bolt 
(which  was  inadvertently  not  removed)  to  a point  at  which  they  caused 
the  sling  adapter  to  fail  in  bending. 
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2.  The  geometry  and  loading  of  the  system  at  the  time  of  failure 
would  rotate  the  oxygen  shelf  about  the  remaining  shelf  attach  bolt  un- 
til the  top  of  oxygen  tank  no,  2 impacted  the  underside  of  the  fuel  cell 
shelf,  causing  the  observed  dent  in  the  shelf, 

3-  Tests  to  reproduce  the  dent  in  the  fuel  cell  shelf  have  been 
conducted  by  striking  a specimen  of  the  shelf  aluminum  honeycomb  ma- 
terial with  an  appropriately  weighted  tank  pinch-off  tube  cover.  The 
test  results  indicate  that  in  order  to  reproduce  the  observed  dent,  a 
maximum  acceleration  of  7g  was  required. 

4.  On  the  basis  of  these  data,  it  does  not  appear  that  the  loads 
transmitted  to  the  internal  components  of  the  tank  during  the  "shelf 
drop"  incident  were  of  sufficient  magnitude  to  cause  any  structural 
failure.  One  possible  effect,  however,  could  have  been  the  displacement 
of  a marginally  secured  connection  between  the  fill  line  and  the  inner 
element  of  the  quantity  gage  capacitor.  Should  this  have  occurred,  it 
could  have  been  the  cause  of  the  detanking  anomaly  experienced  at  KSC 
with  oxygen  tank  no.  2 during  the  preflight  operations  on  Apollo  13. 


Detanking  at  KSC 

The  difficulty  with  the  detanking  of  oxygen  tank  no.  2 subsequent 
to  the  countdown  demonstration  test  (CDDT)  is  described  in  Appendix  C. 

As  noted  in  the  preceding  section,  the  inability  to  detank  may  be  as- 
cribed to  a displacement  of  the  short  Inconel  tube  in  that  portion  of 
the  fill  line  located  in  the  top  of  the  quantity  probe  or  the  absence 
of  this  tube.  Tests  conducted  at  Beech  Aircraft  Corporation  subsequent 
to  the  flight  have  demonstrated  that  if  the  tube  is  displaced  laterally 
about  0.090  inch  from  its  mating  Teflon  adapter,  it  is  not  possible  to 
detank  in  normal  fashion.  The  manufacturing  tolerances  for  this  sub- 
assembly  have  been  discussed  previously,  and  it  is  apparent  that  it  is 
possible  for  such  a displacement  to  occur  if  the  parts  are  at  appropriate 
extremes  of  the  tolerances. 

The  nonstandard  procedure  used  to  detank  oxygen  tank  no.  2 involved 
continuous  power  application  to  the  heaters  at  GSE  power  supply  voltage 
for  8 hours  and  10  minutes.  The  fans  were  operated  for  all  but  the 
first  hour  and  20  minutes  of  this  period.  There  is  no  conclusive  evi- 
dence that  either  of  the  thermostats  ever  operated  to  open  the  heater 
circuits  during  this  period.  This  occurred,  despite  the  fact  that  the 
tank  temperature  sensor  output,  indicating  ullage  space  temperature 
under  the  conditions  of  this  procedure,  was  still  rising  when  the  instru- 
ment reached  its  readout  limit  of  84°  F. 

During  this  detanking,  the  GSE  power  supply  was  providing  approxi- 
mately 6.0  amperes  to  each  of  the  two  heaters  at  approximately  65  V dc 
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at  the  spacecraft.  Tests  conducted  at  MSC  subsequent  to  the  flight 
shoved  that  when  a thermostat  attempted  to  interrupt  a 6. O-ampere 
current  at  65  V dc,  the  contacts  welded  shut.  Whereas  such  contacts 
are  rated  by  the  manufacturer  to  interrupt  at  least  a 6-ampere  alter- 
nating current,  under  direct  current  conditions  a considerable  arc  will 
be  drawn  and  welding  of  the  contacts  will  frequently  result.  At  the 
time  of  this  writing,  three  thermostats  have  been  tested  under  voltage 
and  current  conditions  like  those  experienced  during  the  nonstandard 
detanking.  All  three  failed  by  welding  closed.  Were  the  contacts  in 
oxygen  tank  no.  2 thermostats  to  have  failed  in  this  manner,  which 
seems  highly  probable,  the  heaters  would  have  drawn  current  for  the 
total  period  that  the  circuits  were  energized.  There  are  a number  of 
possible  consequences  of  this  condition.  These  are  discussed  in  the 
following  paragraphs. 

Because  the  wiring  in  the  conduit  in  the  tank  dome  is  of  relatively 
small  diameter  for  the  current  carried,  it  might  lead  to  excessive  wire 
temperatures  by  resistance  heating,  as  this  conduit  represents  a stagnant 
region  with  poor  heat  paths  for  removal  of  the  heat  generated.  Were  the 
temperatures  to  rise  sufficiently,  it  could  degrade  the  insulation  to 
the  point  that  the  wire  might  be  exposed.  Preliminary  calculations  in- 
dicated that  the  temperature  of  the  wires  might  rise  to  the  point  of  in- 
sulation degradation  and/or  melting  of  soldered  connections.  A pre- 
liminary test  using  an  actual  conduit  has  indicated  the  temperature 
would  not  rise  above  about  325°  F,  which  is  well  below  the  threshold 
temperature  for  wire  insulation  and  solder  damage.  More  definitive  data 
on  this  possibility  will  be  provided  by  a test  planned  for  the  near 
future  at  Beech  Aircraft  Corporation.  A flight-type  tank  will  be  sub- 
jected to  a reproduction  of  the  nonstandard  detanking  process  to  deter- 
mine, among  other  things,  how  hot  the  wiring  in  the  conduit  would  get. 

The  second  possible  mode  for  damaging  the  wiring  during  the  de- 
tanking is  related  to  the  pressure  pulsing  employed  during  the  latter 
part  of  the  detanking  operation.  When  the  tank  is  pressurized  and 
quickly  vented,  the  cryogenic  oxygen  will  boil  violently,  probably  pro- 
ducing "slugging'1  or  "geysering"  at  the  liquid-vapor  interface.  This 
action  could  easily  flex  the  large  unsupported  loop  of  wire  that  results 
from  the  assembly  process  and  thus  could  induce  mechanical  damage  to  the 
wire.  This,  too,  must  be  confirmed  by  test  before  it  can  be  considered 
as  more  than  a possibility. 

The  third  possibility  for  inducing  wire  damage  applies  primarily  to 
the  wiring  in  proximity  to  the  heaters--especially  the  fan  motor  leads 
that  are  routed  through  the  12  inches  of  3/l6-inch  diameter  conduit  that 
runs  internal  to  the  heater  probe  (see  fig.  D3-16).  If  the  thermostat 
contacts  failed  by  welding  closed,  as  seems  probable  from  the  results  of 
the  thermostat  tests  described  earlier,  the  heater  probe  metal  tempera- 
tures would  continue  to  rise,  limited  only  by  the  heat  balance  between 
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that  being  generated  by  the  heater  and  that  being  absorbed  by  the  liquid 
and  gaseous  oxygen  in  the  tank.  Were  the  heater  probe  temperatures  to 
rise  above  about  500°  F,  the  wire  insulation  in  its  proximity  would 
begin  to  degrade. 

A test  simulating  prolonged  application  of  power  to  heaters  and 
fans  with  a heater  probe  half  immersed  in  liquid  nitrogen  at  one  atmos- 
phere pressure  was  conducted  at  MSC.  After  8 hours,  a thermocouple 
mounted  directly  on  the  outer  casing  of  a heater  element  at  a location 
where  it  was  in  contact  only  with  the  gaseous  nitrogen  in  the  ullage 
indicated  a surface  temperature  of  about  1000°  F.  At  the  same  time,  the 
temperature  of  the  conduit  wall  reached  735°  F. 

Posttest  inspection  of  the  wiring  indicated  that  the  insulation  had 
been  seriously  degraded  (fig.  D3-24).  The  insulation  had  become  rela- 
tively brittle  and  had  cracked  in  numerous  places.  Upon  any  subsequent 
flexing  of  the  wire,  the  insulation  would  either  break  off  or  shift  to 
widen  the  cracks,  in  either  case  exposing  the  conductor.  Such  an  ex- 
posure would  set  the  stage  for  a future  short  circuit.  The  state  and 
nature  of  the  degradation  of  the  insulation  depends  on  the  temperature 
it  reaches.  It  should  be  noted  that  this  test  was  conducted  in  a nitro- 
gen atmosphere,  whereas  the  actual  prolonged  heater  operation  occurred 
in  an  oxygen  environment.  An  oxygen  environment  is  less  benign  chemi- 
cally than  one  of  nitrogen,  and  greater  degradation  than  that  observed 
might  occur.  The  all-up  test  at  Beech  should  provide  more  definitive 
information  on  this  matter. 

In  summary,  the  nonstandard  detanking  procedure  probably  provided 
the  mechanism  for  initiating  the  flight  failure  by  causing  sufficient 
damage  to  wire  insulation  to  expose  the  conductor (s)  of  the  fan  motor 
leads.  This  would  permit  a short  circuit  to  occur  and  initiate  com- 
bustion within  the  tank.  It  is  also  possible  that  some  solder  was 
melted  during  the  prolonged  heating.  Under  the  normal  gravity  conditions 
on  the  launch  stand,  it  would  be  possible  for  a drop(s)  of  solder  to  fall 
free  and  solidify  and  remain  in  the  tank.  This  could  possibly  lead  to 
the  subsequent  shorting  of  the  capacitor  gage. 


Discussion 

As  described  in  the  preceding  sections,  the  design  of  the  oxygen 
tank  as  a pressure  vessel  is  very  adequate.  It  is  constructed  of  a 
tough  material  well  chosen  for  the  application.  There  is  no  evidence 
of  substandard  manufacture  of  the  particular  tank  involved,  nor  has  any 
evidence  been  found  of  subsequent  damage  that  would  result  in  degrada- 
tion of  the  structural  integrity  of  the  pressure  vessel  (as  distinguished 
from  the  internal  components  of  the  tank). 


Figure  D3-24.-  Photograph  of  vire  damage 


If  the  telemetered  pressure  data  truly  represent  the  pressure  the 
tank  experienced  at  the  time  of  the  accident,  it  should  not  have  failed 
structurally.  The  qualification  burst  test  results  indicate  that  the 
pressure  vessel  is  capable  of  withstanding  over  twice  the  maximum  pres- 
sure indicated  at  the  temperatures  recorded.  The  tubing  is  capable  of 
withstanding  even  greater  loads. 

There  was,  as  described  in  Appendix  B,  an  observed  abnormal  in- 
crease in  pressure  and  temperature  in  the  tank.  As  has  been  discussed 
previously,  there  are  combustibles,  both  metallic  and  nonmetallic,  within 
the  tank,  as  well  as  potential  energy  sources  to  provide  ignition,  es- 
pecially of  the  Teflon  insulation  of  the  internal  wiring.  The  method  of 
assembling  the  tank  system  and  the  details  of  construction  of  the  tank's 
internal  components  provide  an  opportunity  for  wiring  damage.  Also, 
there  is  an  even  greater  probability  that,  in  this  instance,  the  non- 
standard detanking  process  created  bare  conductors.  With  such  damaged 
wiring,  a mechanism  for  creating  a spark  is  provided  and  a consequence 
would  be  a fire  within  the  confines  of  the  tank.  This  would  result  in 
increases  in  the  pressure  and  temperature  within  the  tank. 

There  is  sufficient  Teflon  within  the  tank  to  cause  the  internal 
pressure  to  rise  above  the  burst  strength  of  the  pressure  vessel  were  it 
all  to  be  consumed.  However,  the  locations  of  the  Teflon  components  are 
such  that  igniting  all  of  them  is  not  very  probable.  The  energy  available 
from  the  combustion  of  the  aluminum  within  the  tank  also  exceeds  that 
required  to  burst  the  tank.  Tests  conducted  during  the  investigation 
indicate  that  enough  electrical  energy  was  available  to  initiate  a 
combustion  process  within  the  tank  under  electrical  fault  conditions 
(Appendix  F). 

Among  the  possible  ways  that  the  tank  integrity  could  have  been 
lost,  two  are  worthy  of  special  mention.  First,  should  combustion  have 
existed  within  the  electrical  conduit,  a relatively  stagnant  region  with 
an  intentionally  poor  heat  conduction  path,  the  conduit  walls  would  have 
been  heated  quite  rapidly.  The  conduit  contains  the  greatest  concentra- 
tion of  wiring  and  wire  insulation  within  the  tank.  It  was  estimated 
that  raising  the  conduit  temperature  to  about  1500°  F under  the  pressures 
prevailing  during  flight  would  cause  the  conduit  walls  to  fail.  This 
has  subsequently  been  demonstrated  in  a test  at  MSC  wherein  the  wiring 
insulation  in  an  actual  conduit  was  intentionally  ignited  under  conditions 
simulating  the  conduit  environment  within  the  tank.  In  this  test,  local 
heating  caused  the  conduit  to  fail  a short  time  after  initiation  of 
combustion  within  the  conduit.  Such  a failure  would  result  in  pressuriza- 
tion of  the  tank  vacuum  dome,  leading  to  actuation  of  the  blowout  patch 
and  loss  of  oxygen  tank  pressure. 
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The  second  possibility  is  associated  with  the  reaction  of  aluminum 
with  oxygen.  This  process  has  been  described  as  quite  violent  (see 
Appendix  F).  Were  the  aluminum  to  have  been  ignited  and  if  its  reaction 
rate  under  the  conditions  within  the  tank  were  sufficiently  high,  the 
pressure  could  rise  very  rapidly  and  lead  to  pressure  vessel  failure  at 
burst  pressure  levels.  Such  a pressure  rise  might  not  have  been  evidenced 
in  the  data  because  of  the  low  sampling  rate  of  the  pressure  sensor 
telemetry  signal.  Tests  are  required  to  verify  this  hypothesis. 

A number  of  observations  were  made  during  the  course  of  the  Panel's 
activities  that  gave  rise  to  further  questions.  It  is  recognized  that 
many  of  these  matters  are  of  a subjective  nature.  Nonetheless,  they  are 
considered  worthy  of  comment  in  this  report. 

Oxygen  tank  no.  1 lost  pressure  subsequent  to  the  failure  of  tank 
no.  2.  The  mechanism  of  damage  to  tank  no.  1 has  not  been  established. 

It  is  assumed  to  be  the  result  of  a line  or  valve  failure  in  the  tank 
no.  1 system.  The  two  tanks  and  their  associated  hardware  represent, 
to  a large  degree,  redundant  systems.  They  are,  however,  in  great  part 
colocated.  For  example,  the  tanks  are  adjacent  to  one  another,  the  system 
valves  are  grouped  in  a common  housing,  the  fluid  lines  and  wiring  are 
routed  parallel  to  one  another  in  close  proximity.  Systems  other  than 
the  oxygen  subsystems  have  similar  configurations . Such  practice  provides 
the  possibility  of  inducing  failure  in  a redundant  system  by  a failure 
of  its  companion.  This  is  a most  complex  subject  and  difficult  to  assess. 
It  is  also  recognized  that  much  of  the  hardware  for  Apollo  has  already 
been  built.  There  appears  to  be  a need  for  a review  and  evaluation  of 
this  matter. 

No  evidence  has  been  found  that  indicates  that  shock  testing  of 
components  and/or  s\ibsystem  assemblies  is  a normal  qualification  require- 
ment for  Apollo  service  module  hardware.  The  flight  environment  contains 
shocks  of  a considerable  magnitude  during  events  such  as  staging  of  the 
launch  vehicle.  That  the  effects  of  such  environments  on  system  components 
were  recognized  is  evidenced  by  the  use  of  holding  current  on  the  fuel 
cell  reactant  shutoff  valves,  for  example.  Shocks  can  be  applied  to 
hardware  during  shipment  and  normal  handling,  even  though  elaborate 
precautions  in  the  form  of  special  shipping  containers,  labels,  and 
cautionary  tags  to  alert  transportation  groups  to  the  sensitivity  of 
the  shipment  are  employed.  Good  design  and  development  practice  includes 
experimental  determination  of  margins  against  damage  under  such  circum- 
stances. Again,  there  appears  to  be  a need  for  a review  and  evaluation 
of  the  susceptibility  of  the  components  in  the  spacecraft  to  all  credible 
shock  levels  they  may  encounter  in  their  service  life  so  that  the  margins 
of  safety  inherent  in  their  design  may  be  established. 
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RELATED  SYSTEMS 


As  a result  of  the  Apollo  13  accident , a critical  examination  of 
other  Apollo  systems  is  "being  conducted  by  MSG  to  insure  that  the  potential, 
for  a similar  mode  of  failure  does  not  exist  elsewhere  in  the  spacecraft, 

A member  of  the  Design  Panel  was  present  at  the  MSC  review  meetings.  The 
following  is  a summary  of  the  activity  and  a status  of  the  MSC  effort. 

The  review  was  limited  to  selected  systems  in  the  following  major 
Apollo  elements : 


Command  and  service  module 

Ascent  and  descent  stage  of  the  lunar  module 
Government  furnished  equipment 
Ground  support  equipment 

As  an  aid  in  determining  which  subsystems  should  be  reviewed,  a 
tabulation  of  all  pressure  vessels  in  these  major  elements  was  assembled 
(table  D3-X).  The  cryogenic  oxygen  tank,  which  is  reviewed  in  earlier 
sections  of  this  report,  was  excluded  from  this  review.  Table  D3-XI 
lists  those  systems  and  major  elements  that  were  selected  for  review. 

All  vessels  and  oxygen  and  propellant  line  components  in  the  selected 
systems  are  to  be  analyzed.  The  primary  emphasis  during  the  review  is 
on  the  oxygen  and  oxidizer  systems  and  the  identification  of  all  sources 
of  energy--both  internal  and  external  to  the  system--that  could  result 
in  an  excessive  pressure  rise  and  possibly  result  in  the  failure  or 
degradation  of  a system.  Sources  of  energy  which  were  considered  were 
electrical,  mechanical,  and  solar. 


Pressure  Vessels 

The  pressure  vessels  are  of  concern  in  that  they  represent  large 
energy  sources  in  the  event  of  their  catastrophic  failure.  Qualification 
records  were  reviewed  and  analyzed  to  determine  the  actual  factors  of 
safety  demonstrated  by  burst  test,  as  well  as  the  characteristics  of  the 
failure  modes.  The  failure  modes  of  the  pressure  vessels  have  been  cate- 
gorized as  explosive,  uncertain,  and  benign.  With  these  data,  an  assess- 
ment was  made  of  those  components  that  might  be  damaged  by  the  explosion 
of  a tank  and  the  effect  of  this  explosion  on  the  vehicle  systems  and 
the  crew. 


TABLE  D3-X.-  PRESSURE  VESSELS 
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TABLE  D3-X.-  PRESSURE  VESSELS  - Continued 
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TABLE  D3-XI.-  Subsystems  Selected  for  Review  by  MSC 


Command  module 

Envi r onmen t al  cont rol 
Reaction  control 
Electrical  power 
Mechanical 


Service  module 

Service  propulsion 
Reaction  control 
Electrical  power 

Lunar  module  ascent  stage 

Environmental  control 
Reaction  control 
Ascent  propulsion 
Electrical  power 


Lunar  module  descent  stage 

En v i r onmen t al  control 
Descent  propulsion 
Electrical  power 


Government  furnished  equipment 

Crew  equipment 

Lunar  surface  experiments 

Scientific  instrument  module 


Ground  support  equipment 

Hydrogen  servicing  dewar 
PAD  emergency  air  pack 
High-pressure  oxygen  line  components 
Oxygen/fuel  line  components  with 
electrical  interface 
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The  explosive  failure  of  a pressure  vessel  on  the  spacecraft,  depend- 
ing upon  the  energy  stored  in  the  vessel,  could  result  in  effects  ranging 
from  localized  damage  to  loss  of  spacecraft  and  crew. 

The  following  approaches  were  considered  to  provide  protection  to 
the  spacecraft  and  crew  from  the  catastrophic  explosion  of  a major 
pressure  vessel: 

1.  Isolation  of  the  pressure  vessel  by  separation. 

2.  Controlled  failure  provisions  by  changes  to  the  vent  or 
relief  system  to  permit  rapid  depressurization. 

3.  Containing  the  blast  by  the  addition  of  shielding  by  heavier 
or  strengthened  walls. 

It  was  concluded  that  it  would  be  theoretically  possible  to  provide 
increased,  but  not  total,  protection  for  the  spacecraft  against  the 
catastrophic  explosive  failure  of  a pressure  vessel  if  major  vehicular 
and  pressure  vessel  changes  were  made.  There  are  many  practical  limita- 
tions which  preclude  the  provision  of  total  protection  against  the  cat- 
astrophic explosive  failure  of  a pressure  vessel.  To  determine  the 
effect  on  the  spacecraft  of  a nonexplosive  or  a benign  leakage-type 
failure  of  a pressure  vessel,  the  components  and  materials  in  the  im- 
mediate vicinity  of  the  tank  in  question  were  identified.  Both  the  LM 
and  CSM  have  nonmetallic  materials  which  probably  would  not  survive  if 
they  were  exposed  to  propellants  as  the  result  of  a pressure  vessel 
failure.  It  is  not  feasible  to  use  materials  throughout  the  spacecraft 
which  are  totally  compatible  with  all  fluids  that  they  could  encounter 
following  a primary  failure.  Considering  the  vehicle  and  systems  effects 
of  a pressure  vessel  failure  (leakage  or  explosive),  it  is  clear  that 
neither  containment  nor  complete  nonmetallic  material  compatibility  can 
be  provided  in  the  form  of  practical  or  reasonable  solutions  for  space- 
craft and  crew  protection  against  all  tank  failures.  A tank  failure 
would  result  in  at  least  the  abort  of  a mission,  even  through  the  damage 
from  a pressure  vessel  could  be  contained. 

The  review  of  the  pressure  vessels  of  table  D3-X  identified  a direct 
electrical  interface  or  exposed  wiring  in  the  media  as  follows: 

1.  Propellant  quantity  gaging  systems  in  the  lunar  module  descent 
stage  tanks  and  in  the  service  module  service  propulsion  system  (SPS) 
tanks . 

2.  Capacitance  gage,  heaters,  motors,  and  temperature  sensor  in 
the  cryogenic  hydrogen  tanks  in  the  service  module. 


3.  Quantity  gage  in  the  potable  and  waste  water  tanks  in  the 
command  module. 

4.  Quantity  sensing  gage  in  the  GSE  hydrogen  dewar. 

The  MSC  is  conducting  an  analysis  and  plans  to  perform  tests  on 
the  quantity  gaging  systems  to  insure  that,  the  combination  of  fuel  and 
energy  potential  for  ignition  are  understood  and  represent  no  hazard. 
Associated  with  this  is  a review  of  the  circuitry  and  circuit  protection. 
The  waste  and  potable  water  tanks  are  being  reviewed  to  determine  the 
hazards,  if  any,  of  the  electrical  circuit  and  the  advisability  of  de- 
leting the  quantity  gage. 

The  cryogenic  hydrogen  gas  pressure  vessel  was  reviewed  and  it  was 
verified  that  the  manufacturing  and  assembly  techniques,  as  well  as  the 
arrangement  of  the  internal  components,  are  very  similar  to  those  of 
the  oxygen  tank.  The  same  potential  for  an  electrical  malfunction  in 
the  hydrogen  tank  exists  as  did  in  the  oxygen  tank.  Mission  rules  have 
been  reviewed  and  it  was  determined  that  the  minimum  failure  in  a hydro- 
gen tank  which  would  result  in  a mission  abort  would  be  the  loss  of  two 
heaters  and  one  fan.  The  MSC  is  planning  to  conduct  tests  to  determine 
if  an  electrical  malfunction  can  induce  a sustained  reaction  between 
hydrogen  and  materials  contained  within  the  tank.  Tests  will  also  be 
conducted  to  determine  if  both  heaters  would  fail  following  an  electrical 
malfunction.  Structural  and  materials  compatibility  analysis  and  re- 
views -indicate  that  the  titanium  alloy  (5  Al,  2-1/2  Sn)  as  used  does  not 
experience  hydrogen  embrittlement. 

The  remaining  pressure  vessels  were  reviewed  to  determine  those 
that  had  internal  components,  which  could  expose  an  electrical  interface 
to  the  contained  media  following  a single  failure.  In  addition,  the  non- 
metallics  that  might  be  exposed  following  such  a single  failure  are  being 
identified  to  insure  that  they  are  compatible  with  the  media  at  operating 
conditions. 

The  review  of  the  LM  pressurized  tanks  disclosed  that  helium  and 
oxygen  tanks  are  isolated  from  their  relief  valves  during  the  translunar 
coast  period.  Under  normal  flight  conditions  at  ambient  temperatures 
the  pressure  rise  in  the  tanks  is  relatively  insignificant.  If  protec- 
tive thermal  blankets  on  the  LM  should  be  lost  or  damaged,  the  pressure 
rise  could  be  significant.  A Grumman  study  indicates  that  if  the  com- 
plete loss  of  thermal  blankets  occurred  in  the  areas  of  the  following 
tanks  they  could  reach  burst  pressures  during  translunar  coast: 

Ascent  stage  oxygen 

Ascent  propulsion  system  helium 


Reaction  control  system  helium 
Descent  propulsion  system  helium 


Loss  or  damage  of  a thermal  blanket  could  probably  be  determined 
during  transposition  and  docking  on  all  except  the  descent  helium 
tank.  It  should  be  noted  that  no  rational  failure  mode  has  been  identi- 
fied which  could  result  in  the  loss  or  damage  of  a thermal  blanket. 


Line  Components 

The  line  components  that  are  integral  to  the  systems  in  table  D3-XI 
are  also  being  examined  to  determine  those  with  and  those  without  an 
electrical  interface.  The  electrical  interfaces  are  of  two  types,  direct 
exposure  to  the  media  and  exposure  following  a single  failure.  In  addition, 
all  nonmetallics  near  a potential  ignition  source  will  be  identified 
and  evaluated. 

The  only  component  which  has  been  identified  as  of  this  date  as 
having  nonmetallics  and  a direct  electrical  interface  in  high-pressure 
oxygen  is  the  fuel  cell  reactant  shutoff  valve.  The  Teflon-coated  wires 
internal  to  this  valve,  when  energized,  carry  steady-state  currents  of 
2 amperes  and  transients  of  10  amperes  in  a 900  psi  oxygen  environment. 

The  circuit  protection  consists  of  a 10-ampere  circuit  breaker.  During 
the  launch  and  boost  phase,  a current  limited  circuit,  approximately 
0.5  ampere  at  9 to  10  volts,  is  applied  to  the  "open"  coil  to  insure 
that  the  valve  remains  in  the  open  position.  The  valve  position  sensor 
switch,  which  is  also  internal,  is  continuously  energized  during  the 
entire  mission  from  a 28-volt  circuit  protected  by  a 10-ampere  breaker. 

This  valve  is  now  the  subject  of  an  intensive  review  by  MSC  and  the 
contractor.  There  is  no  indication  that  this  reactant  valve  had  any 
internal  malfunction  during  the  Apollo  13  accident  other  than  the  shock 
closure . 

Components  without  direct  electrical  interfaces  are  also  being 
examined  to  identify  those  in  which  nonmetallic  materials  are  normally 
exposed  to  the  media  and  those  in  which  nonmetallic  materials  could  be 
exposed  following  a single  failure.  To  determine  the  probability  of  a 
single  failure  in  static  components  such  as  temperature  and  pressure 
transducers,  the  acceptance  and  certification  testing  of  critical  elements 
is  being  reviewed.  It  has  been  ascertained  that  component  elements  such 
as  bellows,  probe  cases,  and  internal  diaphragms  are  designed  and  tested 
for  pressure  levels  far  in  excess  of  system  usage.  The  reliability 
reports  confirmed  that  leakage  failure  of  these  elements  has  not  occurred 
on  Apollo  flight  hardware. 


In  addition  to  normal  material  compatibility  determinations,  those 
components  which  have  nonmetallics  used  in  impact  applications  are  being 
identified  and  it  is  planned  that,  where  necessary,  additional  testing 
will  be  conducted  in  the  media  at  appropriate  operating  conditions  to 
determine  that  there  are  no  impact-sensitive  applications. 


Low  Pressure  Oxygen  Systems 

Following  the  Apollo  20h  accident,  the  metallic  and  nonmetallic 
materials  in  the  cabin  of  both  the  command  module  and  lunar  module  were 

subjected  to  an  intensive  review.  As  a result  of  the  research  and 

testing,  the  materials  within  the  LM  and  CM  were  modified  or  changed  to 
reduce  the  probability  of  an  ignition  and  to  minimize  the  combustion 

or  propagation  of  fire  in  the  cabin.  Considering  the  redesign  that  was 

accomplished  and  the  continuing  rigorous  control  of  materials  added  to 
the  spacecraft  cabins,  the  low-pressure  oxygen  systems  (less  than  25  psi) 
were  not  reevaluated  during  this  current  investigation  by  MSC. 


Electrical  Power  System — Batteries 

Both  the  LM  and  the  CSM  use  the  same  type  batteiy  to  initiate  the 
pyrotechnic  functions.  A review  of  the  records  indicated  that  the  G-10 
laminated  glass  epoxy  battery  case  had  not  been  qualified  as  a pressure 
vessel.  The  case  is  protected  by  a relief  valve  which  operates  at 
30  ± 5 psi.  In  the  event  of  a relief  valve  failure,  and  case  pressuriza- 
tion to  rupture,  potassium  hydroxide  could  be  released.  A certification 
program  will  be  conducted  to  establish  the  strength  of  this  battery  case 
and  procedures  established  for  the  acceptance  proof  testing  on  all  flight 
batteries  prior  to  each  mission. 


Ground  Support  Equipment 

This  review  is  structured  to  identify  all  pressure  vessels  and 
line  components  in  propellant  and  high-pressure  oxygen  systems  with 
direct  electrical  interfaces  and  the  associated  metallic  and  nonmetallic 
materials.  All  high-pressure  oxygen,  gaseous  and  liquid,  valve  seat 
material  will  be  identified  as  well  as  any  other  application  of  nonmetallic 
material  in  an  impact  loading  application.  This  MSC  review  is  limited 
to  equipment  supplied  by  North  American  Rockwell  and  Grumman. 

During  the  review  of  the  GSE,  it  was  also  established  that  cleaning 
and  filtering  techniques  used  have  been  generally  effective  in  limiting 
contamination.  Shock-sensitive  materials  have  been  detected  in  the 
liquid  hydrogen  dewar  in  small  quantities  (less  than  1 mg/liter),  which 
are  within  specification  limits  for  nonvolatile  residuals.  The  source 
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and  quantity  of  the  shock-sensitive  materials  should  be  identified,  as 
well  as  the  potential  for  a buildup  in  concentration.  It  is  recognized 
that  contamination  is  not  considered  as  a candidate  cause  for  the 
Apollo  13  accident. 


Certification 

The  certification  records  for  all  pressure  vessels  and  components 
of  the  subsystems  that  were  considered  have  been  reexamined  during  this 
MSC  review.  It  was  established  that  all  certification  requirements  were 
adequately  met,  that  all  discrepancies  were  adequately  explained,  and 
that  all  components  were  qualified  for  flight.  It  should  be  noted  that 
a comparison  of  the  certification  requi rements  with  the  expected  flight 
and  ground  environment  was  not  part  of  this  review. 


Apollo  J-Missions 

Both  the  CSM  and  LM  systems  are  being  modified  to  support  the 
extended  lunar  stay  time  and  lunar  orbit  experiments  for  later  Apollo 
missions.  The  MSC  review  included  the  nitrogen  bottle  being  added  to 
the  scientific  instrument  module  of  the  service  module  for  the  Pan 
camera.  The  other  system  changes  and  additions  to  the  IM  and  CSM  for 
the  J-Mission  consist  of  the  addition  of  more  pressure  vessels  and 
components  of  the  types  already  installed  in  the  spacecraft  and  examined 
during  this  review.  No  new  pressure  vessels  or  components  are  planned. 


Lunar  Module  "Lifeboat" 

Associated  with  the  Related  Systems  Review,  MSC  is  also  analyzing 
how  the  "lifeboat"  capability  of  the  IM  could  be  enhanced.  The  LM, 

CSM,  and  PLSS/uPS  are  being  reviewed  to  determine  what  minor  modifications 
to  the  concerned  systems  and/or  changes  in  procedures  should  be  incor- 
porated. The  intent  of  the  changes  would  be  to  enhance  the  ability  of 
the  crew  to  interchange  or  transfer  oxygen,  water,  electrical  power, 
and  lithium  hydroxide  cannisters  between  spacecraft  and  to  increase  the 
probability  of  crew  survival  following  multiple  failures  in  the  command 
module . 


DISCUSSION 


As  a result  of  the  MSC  Related  Systems  Reviews  that  have  been 
completed  and  are  still  in  progress,  the  following  observations  are 
offered. 


D-87 


A fracture  mechanics  analysis  was  made  of  all  Satum-Apollo  pressure 
tanks  by  the  Boeing  Company  for  NASA  in  1968- 1969  (ref.  40).  However, 
most  of  these  tanks  were  designed  without  consideration  of  fracture 
mechanics.  Consequently,  at  the  time  of  the  Boeing  analysis,  some  pertinent 
data  were  not  available.  For  example,  sustained  load  and  cyclic  load 
flaw  growth  data  were  not  available  for  Inconel  718  electron  beam  welds 
such  as  are  used  in  the  supercritical  oxygen  tanks  and  in  the  GOX  tanks 
of  the  1M  ascent  stage.  These  data  are  now  being  generated  in  a current 
program  at  Boeing,  sponsored  by  NASA.  It  is  also  understood  that  sustained 
load  flaw  growth  data  are  not  available  for  a D6aC  steel  GOX  tank  in  the 
LM  descent  stage.  Until  very  recently  (ref.  4l)  sustained  load  flaw 
growth  data  were  not  available  for  the  cryoformed  301  GOX  tanks  used  in 
the  PLSS  and  the  PAD  pack.  It  is  entirely  possible  that  the  new  data 
will  not  change  the  conclusions  derived  from  the  original,  fracture 
mechanics  analysis;  however,  it  is  advisable  to  reexamine  the  Boeing 
analysis  of  the  spacecraft  pressure  vessels  with  a view  to  incorporating 
the  latest  information.  As  an  example,  particular  attention  is  warranted 
for  the  6Al-UV-Ti  tanks  containing  nitrogen  tetroxide,  since  nitrogen 
tetroxide  is  a potentially  aggressive  environment  for  titanium.  It  is 
recognized  that  elaborate  precautions  are  presently  being  taken  to 
control  the  service  conditions  of  these  tanks  in  such  a way  that  sustained 
load  crack  growth  should  not  occur  during  a mission. 

To  assure  that  no  unsatisfactory  materials  are  used  in  oxygen/ 
oxidizer  systems  in  future  spacecraft,  it  is  advisable  to  examine  all 
components  and/or  elements  for  compatibility  (including  dynamic  applica- 
tions) in  their  media.  Where  compatibility  data  at  the  appropriate 
service  conditions  are  not  available,  tests  should  be  conducted. 

It  appears  appropriate  to  conduct  tests  with  typical  hydrogen 
tank  materials  in  hydrogen,  at  system  operating  conditions,  to  determine 
if  an  exothermic  reaction  can  be  initiated  by  electrical  fault. 

It  would  be  appropriate  to  expand  the  MSC  investigation  to  include 
a review  of  the  manufacturing  processes  used  in  the  fabrication  of 
critical,  tanks  and  components  to  insure  that  the  processes  used  are  not 
conducive  to  inducing  failures. 

A reevaluation  of  the  filtration,  sampling,  and  analysis  of  the 
gases  and  fluids  used  is  considered  appropriate  to  insure  that  the 
requirements  for  cleanliness  and  purity  in  the  servicing  of  spacecraft 
systems  are  being  satisfied. 

It  may  be  advisable  to  conduct  investigations  of  the  compatibility 
of  the  nonmetallics  in  the  launch  vehicle  oxygen  and  oxidizer  systems, 
as  well  as  spacecraft  and  launch  vehicle  GSE  (with  emphasis  on  impact 
sensitivity  at  operating  conditions). 
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PART  D4 


SUMMARY 


The  Design  Panel  conducted  a review  and  evaluation  of  the  design 
of  those  elements  of  the  Apollo  spacecraft  systems  that  were  implicated 
as  contributing  to  the  Apollo  13  accident.  These  comprise  primarily  the 
oxygen  tanks  of  the  service  module,  the  associated  valves,  plumbing,  and 
electrical  systems.  In  addition,  the  Panel  surveyed  other  systems  with- 
in the  spacecraft  to  determine  whether  their  designs  contained  potential 
for  failures  similar  to  those  of  the  oxygen  tank. 

During  its  considerations,  the  Panel  examined  the  tank  in  two  con- 
figurations. The  first  was  in  the  configuration  as  defined  by  the  draw- 
ings and  other  controlling  documentation.  The  second  configuration  was 
what  might  be  termed  the  "as  flown"  condition,  that  is,  containing  such 
variations  from  standard  as  may  have  resulted  from  unusual  events  in  the 
history  of  oxygen  tank  no.  2.  The  following  were  the  two  most  signifi- 
cant such  events: 

1.  The  oxygen  "shelf  drop"  incident  during  spacecraft  manufacture. 

2.  The  unorthodox  detanking  procedure  employed  at  KSC  made  necessary 
by  inability  to  detank  in  the  standard  manner. 

The  following  observations  result  from  this  review: 

1,  As  a pressure  vessel,  that  is,  from  a structural  viewpoint,  the 
tank  is  adequately  designed.  The  pressure  vessel  is  constructed  of  a 
tough  material  well  chosen  for  this  application.  The  stress  analyses 
and  results  of  the  qualification  burst  test  program  confirm  the  ability 
of  the  tank  to  exhibit  adequate  structural  performance  in  its  intended 
application. 

2.  From  a systems  viewpoint,  the  design  of  the  oxygen  tank  is 
unsatisfactory.  The  design  features  of  the  tank  system  are  such  that: 

(a)  It  is  difficult  to  install  the  internal  components  of  the 
tank.  The  design  is  such  that  this  operation  is  "blind"  and  not  amenable 
to  visual  inspection  after  completing  the  installation. 

(b)  There  is  power  wiring  internal  to  the  tank  exposed  to 
supercritical  oxygen. 

(c)  There  is  great  potential  for  damage  to  internal  wiring 
during  assembly.  There  are  sharp  corners  on  metal  parts  in  proximity 


to  the  wires;  the  wiring  is  routed  over  rather  tortuous  paths;  the 
wiring  is  located  in  close  proximity  to  rotating  components  and  to  the 
heater  elements;  and  the  wiring  is  free  to  be  flexed  by  moving  fluid 
during  fan  operation  and/or  during  filling  or  emptying  of  the  tank  with 
gaseous  or  liquid  media, 

(d)  The  rating  of  the  thermostats  in  the  heater  circuits  is 
not  compatible  with  the  voltages  that  are  (and  in  this  instance  were  for 
a prolonged  period)  applied  to  these  circuits  at  the  launch  site. 

(e)  There  are  combustible  materials  within  the  tank,  such  as 
Teflon,  solder,  aluminum,  and  drilube  822. 

3*  The  combination  of  combustible  materials  and  potential  ignition 
sources,  including  the  use  of  unsealed  electric  motors,  constitutes  a 
hazard  that  can  lead  to  a fire  within  the  tank. 

h.  The  manufacturing  tolerances  of  the  Teflon  adapters,  short 
Inconel  tube,  and  quantity  gage  center  tube  that  comprise  the  tank  fill 
and  drain  tube  are  such  that  extremely  loose  fit  can  occur.  If  these 
elements  were  at  or  near  the  appropriate  dimensional  extremes  in  tank 
no.  2,  it  is  possible  that  mechanical  shock  could  cause  a disengagement 
of  these  parts  that  could  have  led  to  inability  to  detank.  Such  might 
have  been  caused  by  the  "shelf  drop"  incident. 

5.  The  nonstandard  detanking  of  oxygen  tank  no.  2 at  KSC  probably 
led  to  the  degradation  of  the  insulation  of  the  internal  wiring.  The 
insulation  probably  became  brittle,  and  flexing  of  the  wire  either  during 
or  subsequent  to  the  detanking  could  cause  it  to  break  off,  exposing 

the  conductor.  This  would  provide  a means  for  creating  an  electrical, 
short  that  could  initiate  combustion  of  the  insulation.  The  planned 
all-up  test  reproducing  the  detanking  should  provide  data  to  conclusively 
verily  this. 

6.  The  fuel  cell  oxygen  shutoff  solenoid  valve  has  power  wiring 
and  combustibles  exposed  to  a 900  psi  oxygen  environment  and  is  protected 
by  a 10-ampere  circuit  breaker.  The  combination  of  combustibles, 
potential  ignition  source,  and  oxygen  within  this  device  constitutes  a 
hazard  similar  to  that  prevailing  within  the  oxygen  tank. 

7.  The  caution  and  warning  indicators  in  the  CM  for  the  fuel  cell 
reactant  shutoff  valves  use  series  logic.  This  logic  requires  that  both 
the  hydrogen  and  oxygen  reactant  valves  be  closed  in  order  that  a warning 
indication  may  be  given.  Therefore,  it  is  possible  for  a fuel  cell  to 

be  deprived  of  one  of  its  reactants  because  of  a closed  valve  and  thus 
suffer  irreversible  damage  without  the  crew  being  made  aware  of  this 
state  via  the  caution  and  warning  indicators. 
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8.  Loss  of  a main  bus  deprives  some  of  the  talkback  indicators 
of  actuating  power.  In  such  an  eventuality,  misinformation  as  to  the 
state  of  certain  valves  may  be  presented  to  the  crew  when  valid  informa- 
tion as  to  status  of  system  components  is  most  vital. 

9.  The  logic  of  the  master  alarm  feature  of  the  caution  and  warning 
system  is  such  that  preexistence  of  an  operationally  expected  signal 
(within  a given  subsystem)  such  as  "hydrogen  pressure  low"  prevents 
receipt  of  a master  alarm  for  a second,  and  possibly  dangerous,  condition 
such  as  high  oxygen  pressure. 

As  a result  of  these  observations,  it  is  the  consensus  of  the  Design 
Panel  that  the  Board  should  give  consideration  to  including  the  following 
among  its  recommendations. 

The  internal  components  of  the  oxygen  tank  system  should  be 
redesigned.  The  requirement  for  the  functions  performed  by  these 
components  should  be  reevaluated  carefully.  If  it  is  determined  that 
some  or  all  of  these  components  are  mandatory  for  accomplishing  the 
mission,  the  redesign  should  be  of  such  nature  as  to  minimize  the  amount 
of  potentially  combustible  material  within  the  tank.  The  installation 
of  any  wiring  that  must  be  within  the  tank  should  be  so  designed  as  to 
preclude  direct  contact  with  the  oxygen  if  at  all  possible.  As  a 
minimum,  wiring  must  not  be  in  contact  with  the  oxygen  if,  under  fault 
conditions,  sufficient  energy  is  available  to  ignite  proximate  materials. 
Determination  of  what  constitutes  sufficient  energy  for  ignition  should 
be  based  on  data  from  tests  conducted  under  all  conditions  that  would 
be  encountered  in  service.  It  would  be  preferable  that  any  redesign  of 
the  internal  components  permit  assembly  of  these  components  into  a 
total  subsystem  outside  the  tank.  This  would  permit  thorough  inspection 
and  test  prior  to  installation  within  the  pressure  vessel. 

The  fuel  cell  reactant  shutoff  valve  should  either  be  redesigned 
to  eliminate  electrical  wiring  in  contact  with  high-pressure  oxygen 
or  a suitable  substitute  valve  be  found. 

The  logic  of  the  caution  and  warning  system  should  be  reviewed  with 
a view  towards  eliminating  lack  of  a warning  indication  for  a single 
malfunction  that  can  cause  irreparable  loss  of  a mission-critical 
component.  The  logic  of  the  master  alarm  feature  of  the  caution  and 
warning  system  should  also  be  reviewed  with  the  view  towards  eliminating 
the  feature  that  precludes  the  receipt  of  a second  alarm  in  the  presence 
of  a preexisting  alarm  from  the  same  system  or  subsystem.  The  possibility 
of  providing  a redundant  power  supply  to  permit  proper  functioning  of 
talkback  type  indicators  in  the  event  of  loss  of  the  main  bus  normally 
supplying  power  to  the  indicators  should  also  be  examined  with  a view 
to  providing  a valid  indication  to  the  crew  in  the  event  of  such  a mal- 
function. 
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The  ability  of  components  to  perform  their  appropriate  functions 
without  damage  when  exposed  to  shock  loading  levels  in  excess  of  those 
anticipated  to  be  encountered  in  flight  or  in  ground  handling  should  be 
demonstrated  by  tests.  Components  found  wanting  in  this  respect  should 
be  either  modified  or  replaced. 

The  comprehensive  review  initiated  by  the  MSC  Apollo  13  Investiga- 
ting Team  of  all  CSM  and  LM  tanks,  valves,  and  associated  system  elements 
in  which  oxygen  or  oxidizers  are  stored,  controlled,  or  distributed 
should  be  prosecuted  vigorously.  The  acceptability  of  materials  within 
such  components  should  be  established  by  tests  conducted  under  fluid 
conditions  like  those  that  will  be  encountered  in  service  both  on  the 
ground  and  in  flight.  In  addition,  the  review  should  be  expanded  to 
include  the  manufacturing  and  assembly  procedures  employed  in  the 
fabrication  of  those  of  the  previously  noted  components  which  are 
determined  to  contain  hazards. 
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PAET  El 


TASK  ASSIGNMENT 


The  Project  Management  Panel  was  established  by  the  Apollo  13 
Review  Board  to  review  those  management  systems  in  the  Apollo  Program 
which  were  pertinent  to  the  Apollo  13  accident.  In  effect,  this  task 
required  the  review  of  all  appropriate  design,  manufacturing,  and  test 
procedures  covering  vehicle  systems  which  may  have  failed  in  flight, 
including  the  means  by  which  various  organizations  coordinated  their 
individual  efforts  in  the  total  process.  The  Panel  took  special  care 
to  evaluate  carefully  the  safety  management  system  which  was  applicable 
to  Apollo  13- 

Principal  questions  addressed  by  the  Management  Panel  focused  on 
the  organization,  procedures,  and  systems  used  to  monitor  and  control 
CSM  design,  manufacturing,  test,  assembly,  and  final  certifications  of 
flight  equipment,  and  particularly  of  the  cryogenic  oxygen  system  used 
in  the  service  module  electric  power  system  and  environmental  control 
system. 
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PANEL  MEMBERSHIP 


Panel  4 was  chaired  by  Mr.  E.  C.  Kilgore,  Deputy  Chief,  Engineering 
and  Technical  Services,  Langley  Research  Center.  The  Board  Monitor  was 
Mr.  Milton  Klein,  Manager,  AEC-NASA  Space  Nuclear  Propulsion  Office. 
Panel  members  were: 

Mr.  R.  D.  Ginter,  Director,  Special  Program  Office 
Office  of  Advanced  Research  and  Technology  (OART) 

NASA,  Headquarters,  Washington,  D.C. 

Mr.  Merrill  Mead,  Chief,  Programs  and  Resources  Office 
Ames  Research  Center 
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Mr.  James  B.  Whitten,  Asst.  Chief,  Aeronautical  and  Space 
Mechanics  Division 
Langley  Research  Center 
Hampton,  Virginia 

In  addition,  Mr.  R.  C.  Puffer  of  MSC  Security  assisted  the  Panel  by 
preparing  the  section  of  the  report  on  Security. 
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SUMMARY 


INTRODUCTION 


The  Management  Panel  carried  out  a detailed  in-depth  review  of  the 
Apollo  Spacecraft  Program  Office  organizational  structure  and  the  manage- 
ment system  used  to  control  both  command  and  service  module  (CSM)  hard- 
ware development  and  decision-making  processes.  The  review  examined  the 
system  for  Apollo  and  focused  attention  on  the  specific  cryogenic  oxygen 
tank  directly  involved  in  the  Apollo  13  accident.  Key  management  per- 
sonnel at  the  Manned  Spacecraft  Center  (MSC),  the  Kennedy  Space  Center 
(KSC),  and  Apollo  contractors  and  subcontractors  were  interviewed.  These 
interviews  were  specifically  aimed  at  understanding  what  decisions  were 
made  regarding  the  oxygen  tank  system  for  Apollo  13,  who  participated  in 
these  decisions,  what  information  was  available  from  the  management 
system,  how  effectively  the  organizational  elements  functioned  in  review- 
ing, communicating,  and  carrying  out  assigned  responsibilities,  and 
whether  management  system  changes  are  required  in  view  of  the  oxygen 
tank  accident.  Records  of  the  oxygen  tank  reviews,  discrepancy  reports, 
failure  reports,  and  procedures  were  examined  to  determine  if  the  review 
systems  and  configuration  control  system  functioned  as  they  were  intend- 
ed. Separate  reviews  were  made  of  the  Security,  Safety,  and  Reliability 
and  Quality  Assurance  (R&QA)  management  systems  to  determine  effectiveness. 

Visits  were  made  to  the  CSM  prime  contractor.  North  American  Rock- 
well (NR),  Downey,  California,  and  to  the  oxygen  tank  subcontractor, 

Beech  Aircraft,  Boulder,  Colorado,  during  which  discussions  were  held 
with  key  design,  test,  and  manufacturing  personnel.  Reliability  inspec- 
tion, safety,  configuration-control  and  process-control  procedures  and 
systems  were  reviewed  and  examined  in  detail.  KSC  operations  were  re- 
viewed and  discussions  were  held  with  key  test  and  launch  operations 
personnel  regarding  their  responsibilities,  procedures,  and  controls. 
Similar  discussions  were  held  with  MSC  Apollo  CSM  key  management  and 
engineering  personnel.  Throughout  its  analysis,  the  Panel  devoted  par- 
ticular attention  to  the  history  of  the  Apollo  13  cryogenic  oxygen  tank 
no.  2 including  design  and  manufacturing  waivers,  discrepancies,  and 
anomalies  and  how  these  were  handled  by  the  Apollo  management  team. 


General  Technical  Capability 

The  Panel  found  key  Apollo  personnel  to  be  technically  capable  and 
dedicated  to  producing  a reliable  and  safe  spacecraft  system.  Although 
there  have  been  cutbacks  in  the  total  number  of  Apollo  personnel,  the 
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morale  of  the  remaining  Apollo  team  is  considered  by  officials  inter- 
viewed to  be  high.  Reductions  in  personnel  complements  as  the  flight 
rate  has  been  reduced  have  not  detrimentally  impacted  the  experience 
level  within  the  Program  to  this  point.  Moreover,  critical  flight  and 
ground  system  personnel  requirements  have  been  carefully  reviewed  by 
project  officials  to  insure  adequate  manning.  During  the  Apollo  Program, 
there  have  been  changes  in  key  management  personnel.  The  Panel  found 
that  attention  was  given  to  maintaining  continuity  of  experience  by 
essentially  promoting  from  within  the  Apollo  Program.  Some  technicians 
with  considerable  CSM  experience  have  been  replaced  at  NR-Downey  by 
technicians  from  other  programs  with  more  seniority,  but  no  CSM  experi- 
ence. This  was  recognized  as  a potential  problem  and  an  intensified 
training  program  was  instituted.  Continued  surveillance  of  the  con- 
tractor technician  experience  level  and  capability  is  necessary. 


Division  of  Responsibilities 

The  Apollo  spacecraft  organization  involves  a large  number  of  con- 
tractor, subcontractor,  and  Government  organizations.  It  was  found 
that  these  organizations  understand  their  individual  responsibilities 
and  that  necessary  coordination  processes  were  in  effect.  This  process 
provides  a system  of  checks  and  cross-checks  to  assure  that  detailed 
consideration  and  attention  is  given  to  problems  by  the  right  organiza- 
tions prior  to  final  flight  commitment. 


Cryogenic  Oxygen  Tank  Design 

Apollo  oxygen  tank  no.  2 was  designed  in  the  1962-1963  time  period 
by  Beech  prior  to  the  formation  of  the  formal  design  review  and  sub- 
system manager  systems  which  now  exist  at  MSC.  During  the  design  phase, 
there  was  limited  participation  by  MSC  technical  personnel  in  the  early 
design.  The  primary  emphasis  at  this  time  by  both  the  prime  contractor 
and  MSC  was  on  the  thermodynamic  performance  of  the  oxygen  system.  The 
tank  did  receive  informal  design  reviews  primarily  by  NR  and  Beech  per- 
sonnel. Even  though  these  reviews  were  made,  it  was  found  that  the 
final  design  resulted  in  a complex  assembly  procedure  with  a wiring 
cluster  which  cannot  be  inspected  after  assembly  in  the  tank.  However, 
the  complexity  of  the  assembly  and  the  inability  to  inspect  the  tank 
interior  components  after  assembly  was  recognized  by  Government,  NR, 
and  Beech  personnel.  Consequently,  a detailed  step-by-step  manufactur- 
ing and  assembly  procedure  was  established  and  carried  out  with  checklist- 
type  Beech  inspections,  supplemented  by  NR  and  Government  inspections 
at  defined  critical  points.  A First  Article  Configuration  Inspection 
(FACl)  was  held  on  the  oxygen  tank  in  1966  which  was  jointly  signed  off 
by  MSC  and  contractor  subsystem  managers.  No  subsequent  formal  design 
reviews  were  held. 
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A thermostatic  switch  (thermal  switch)  was  incorporated  into  the 
Block  I oxygen  tank  heaters  to  avoid  overheating  while  using  28  V dc 
spacecraft  power.  After  receipt  of  the  Block  II  oxygen  tank  specifica- 
tions from  NR  in  February  1965,  which  required  the  tank  heater  to  oper- 
ate not  only  on  28  V dc  spacecraft  power  but  also  with  65  V dc  GSE  for 
rapid  tank  pressurization  during  launch  operations  at  KSC,  Beech  did  not 
require  their  Block  I thermal  switch  supplier  to  make  a change  in  switch 
rating.  NR  never  subsequently  reviewed  the  heater  assembly  to  assure 
compatibility  between  the  GSE  and  the  thermal  switch.  This  resulted,  in 
NR,  MSC,  and  KSC  personnel  subsequently  assuming  that  the  tank  was  pro- 
tected from  overheating  while  using  the  65  V dc  power  supply. 


Configuration  Control  Procedures 

The  Panel  found  that  a strict  and  rigorous  management  system  exists 
on  the  CSM  for  configuration  control,  problem  reporting,  customer  accept- 
ance readiness  reviews,  and  flight  readiness  reviews.  Both  contractors 
and  Government  CSM  organizations  participate  in  this  system.  R&QA  or- 
ganizations independently  monitor,  record,  and  report  all  problems  and 
approved  resolutions.  Examination  of  documentation,  such  as  failure 
reports,  discrepancy  reports,  and  waivers  generated  in  the  management 
system  and  applicable  to  the  Apollo  13  oxygen  tank,  demonstrated  to  the 
Panel  that  the  management  system  was  being  followed  closely.  Closeouts 
were  being  accomplished  with  authorized  approvals. 


Oxygen  Tank  Handling  Incident  at  Downey 

In  the  case  of  the  Apollo  13  oxygen  tank  handling  incident  at  NR- 
Downey,  the  Panel  found  that  a Discrepancy  Report  was  written  and  func- 
tional tests  were  made  by  NR  Engineering.  The  incident  was  judged  to 
have  caused  no  tank  damage  by  the  contractor's  systems  engineers  and 
representatives  of  the  RASPO  at  Downey.  Also,  the  oxygen  tank  subsystems 
manager  at  MSC  was  made  aware  of  the  incident.  Subsequent  functional 
tests  were  successfully  passed.  The  Discrepancy  Report  was  closed  out 
in  the  authorized  manner.  Although  the  handling  incident  was  not  re- 
ported to  the  Apollo  Spacecraft  Program  Manager,  it  should  be  noted  that 
such  reporting  of  Discrepancy  Report  closeouts  is  not  required  in  all 
cases.  Once  this  incident  was  closed  out  in  the  manner  prescribed  by 
the  Apollo  management  control  system,  it  was  not  reopened  as  a possible 
factor  relating  to  the  later  detanking  problem  at  KSC. 


KSC  Detanking  Problems 

In  the  case  of  the  detanking  problem  at  KSC,  it  was  found  that 
all  authorized  Discrepancy  Reports  were  filed  and  signed  off.  The 
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change  from  normal  detanking  procedures  was  made  to  use  the  tank  heaters 
and  fans  in  an  attempt  to  boil  off  the  liquid  oxygen  in  the  tank.  This 
was  unsuccessful  and  the  normal  procedure  was  further  altered  by  use  of 
a pressure  pulsing  method.  These  changes  to  the  test  procedures  were 
made  by  the  KSC  Systems  Engineer  and  NR  Systems  Engineer  who  were  on 
station.  They  obtained  concurrence  of  the  NR  lead  systems  engineer  at 
KSC.  This  is  in  agreement  with  the  present  requirements  for  test  pro- 
cedural changes.  After  the  pressure  pulsing  method  was  used  to  detank 
oxygen  tank  no.  2,  the  problem  received  further  attention,  including 
additional  analyses  and  test.  The  Apollo  team  problem-solving  effort 
that  resulted  was  led  by  the  MSC  Apollo  Spacecraft  Program  Manager  and 
the  KSC  Director  of  Launch  Operations.  NR  and  Beech  personnel  were  also 
involved.  The  MSC  Apollo  Spacecraft  Program  Office  formulated  a check- 
list of  analyses  to  be  made  and  questions  to  be  answered  prior  to  making 
the  flight  decision  on  the  tank. 

This  included: 

1.  Details  and  procedures  for  normal  detanking  at  Beech  and  KSC. 

2.  Details  of  abnormal  detanking  at  KSC  on  March  27  and  28. 

3.  Hazards  resulting  from  a possible  loose  fill  tube  in  the 
oxygen  tank. 

4.  Can  the  tank  be  X-rayed  at  KSC? 

5.  Could  loose  tolerances  on  the  fill  tube  cause  detanking 
problem? 

6.  Should  a blowdown  and  fill  test  be  made  on  the  tank? 

7*  Disassemble  an  oxygen  tank  on  Service  Module  2 TV-1  and 
examine  components . 

A detailed  analysis,  including  possible  failure  modes,  was  made  at 
Beech.  Tests  were  run  which  indicated  that  even  in  the  event  of  a loose 
metal  fill  tube  (which  was  concluded  to  be  the  most  likely  cause  of  the 
detanking  problem),  a resultant  electrical  short  would  provide  only  7 
millijoules  of  energy  and  it  was  judged  that  this  energy  level  could 
cause  no  damage  except  loss  of  the  quantity  gage  indication.  All  of  the 
checklist  requirements  were  met  by  test  or  analysis  prior  to  making  the 
decision  to  fly  without  a change  in  the  oxygen  tank.  It  was  jointly 
concluded  by  the  Beech  Apollo  Program  Manager,  the  NR  CSM  Program 
Manager,  the  KSC  Director  of  Launch  Operations,  and  the  MSC  Apollo 
Spacecraft  Program  Office  (ASPO)  Manager  that  the  tank  was  flightworthy. 
Further  examination  of  this  event  since  the  Apollo  13  accident,  however, 
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has  revealed  that  incomplete  and,  in  some  cases,  incorrect  information 
was  used  in  the  decision  process.  This  included: 

1.  Neither  the  KSC  Launch  Operations  Director  nor  the  MSC  ASPO 
Manager  knew  of  the  previous  tank  handling  incident  at  NR-Downey  and 
neither  knew  that  the  oxygen  tank  internal  heaters  we re  on  for  8 con- 
secutive hours  during  detanking  at  KSC.  Key  personnel  at  NR-Downey 
knew  of  both  events.  No  personnel  at  MSC,  KSC,  or  NR  knew  that  the  tank 
heater  thermal  switches  would  not  protect  the  tank  from  overheating. 

2.  A portion  of  the  normal  detanking  process  at  Beech  is  similar 
to  the  normal  detanking  process  at  KSC.  The  KSC  Launch  Operations 
Director  and  MSC  ASPO  Manager  were  mistakenly  informed  that  they  were 
different,  (if  they  had  known  of  the  similarity  in  detanking  processes, 
they  possibly  would  have  concluded  that  some  change  took  place  in  the 
tank  between  Beech  and  MSC.) 

3.  The  KSC  Launch  Operations  Director,  the  MSC  ASPO  Manager,  and 
key  personnel  at  Downey  mistakenly  understood  that  the  oxygen  tank  on 
previous  test  Service  Module  2 TV-1  had  similar  detanking  problems 
which  led  to  the  decision  to  disassemble  the  2 TV-1  tank  and  examine 
the  components.  That  examination  was  interpreted  as  evidence  that  a 
loose-fitting  metal  fill  tube  probably  was  causing  the  detanking  diff- 
culty.  Further  examination  has  revealed,  however,  that  2 TV-1  oxygen 
tank  probably  detanked  normally. 

Although  none  of  the  principals  in  making  the  oxygen  tank  decision 
(NR,  MSC,  KSC)  can  say  with  certainty  that  the  availability  of  informa- 
tion in  1,  2,  and  3,  above  would  have  altered  their  decision,  each  con- 
curs that  the  availability  of  such  information  could  have  altered  their 
decisions . 

On  the  basis  of  its  review,  the  Project  Management  Panel  feels  the 
following  observations  to  be  pertinent: 

1.  Launch  operations  personnel  did  not  fully  understand  the  oxygen 
tank  internal  components  or  fully  appreciate  the  possible  effect  of 
changed  detanking  procedures  on  the  reliability  of  such  internal 
components . 

2.  The  hazard  associated  with  the  long  heater  cycle  was  not  given 
consideration  in  the  decision  to  fly  this  tank. 
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3.  Problem  solving  during  launch  operations  utilized  telephone 
conferences  among  knowledgeable  parties,  but  without  subsequent  written 
verification,  which  would  have  permitted  more  deliberate  consideration 
and  review. 

k.  Deviations  from  test  procedures  during  tests  at  KSC  were  made 
in  accordance  with  the  established  approval  process.  This  does  not 
require  prior  approval  or  concurrence  of  NR-Downey  or  MSC  subsystem 
specialists. 

5.  It  was  found  that  insufficient  consideration  was  given  to  the 
tank  internal  details  such  as  sharp  edges,  internal  wiring,  and  heater 
thermal  switch  ratings  during  the  design  reviews. 

6.  An  historical  record  of  the  oxygen  tank  existed  in  the  manage- 
ment system  files.  However,  it  was  not  referred  to  in  making  the  flight 
decision. 


7 . Dependence  upon  memory  of  personnel  led  to  erroneous  data 
being  reported  to  higher  management  levels. 

8.  Key  Apollo  management  personnel  made  several  suggestions  dur- 
ing the  Panel  interviews: 

(a)  Provide  total  background  history  on  subsystems  which  have 
problems  or  anomalies  during  launch  operations. 

(b)  Launch  operations  personnel  need  more  knowledge  of  the 
internal  details  of  subsystems. 

(c)  NR  (Downey)  and  MSC  Subsystem  Managers  should  review 
KSC  test  procedures  and  subsequent  procedure  changes. 

(d)  Verification  of  data  is  needed  in  problem  solving. 

(e)  Followup  documentation  of  information  exchanged  during 
telephone  conferences  on  key  problems  is  recommended. 


Materials  Compatibility 

.The  compatibility  of  oxygen  tank  materials  with  oxygen  received 
consideration  in  the  original  design.  Beech  reviewed  and  selected  the 
tank  materials  in  accordance  with  the  published  material  knowledge  that 
existed  in  the  1962-1963  time  period.  No  data  on  hot-wire  tests  or 
ignition  tests  were  available  to  Beech  at  that  time.  Beech  ran  special 
tests  on  the  fan  and  motor  assembly  which  was  tested  at  1000  psia  in 
oxygen  gas  at  300°  F.  The  motor  passed  this  test  with  no  evidence  of 
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ignition.  Some  attention  was  paid  in  the  assembly  procedures  to  avoid 
pulling  wires  over  threads  or  sharp  corners  and  to  provide  protective 
sleeving.  However,  most  sharp  corners  were  not  eliminated  and  as  was 
previously  mentioned,  the  tank  design  necessitated  a blind  assembly 
with  no  way  for  subsequent  inspection  for  damage.  After  the  original 
design,  Beech  was  not  requested  by  NR  to  make  any  further  materials 
compatibility  study  or  tests.  In  April  1969*  HR  was  directed  by  MSC  to 
review  the  nonmetallic  materials  in  the  cryogenic  oxygen  subsystem  and 
document  them  in  accordance  with  the  COMAT  (Characteristics  of  Materials 
System).  All  nonmetallic  materials  in  the  oxygen  tank  were  evaluated 
and  documented  by  HR.  All  nonmetallic  materials  met  the  requirements  of 
the  materials  control  program.  These  materials  criteria  were  specifi- 
cally formulated  for  the  lunar  module  and  command  module,  where  non- 
propagation of  fire  was  a requirement  even  if  a fire  started. 

These  COMAT  requirements  do  not  adequately  cover  the  $00  psi  cryo- 
genic oxygen  tank.  Ho  electrical  ignition  testing  of  any  materials  was 
made  for  the  oxygen  tank.  HR  reviewed  the  service  module  systems  to 
provide  electrical  circuit  protection  such  as  breakers  and  fuses  in  1967 
in  an  effort  to  avoid  electrical  fires  in  case  of  shorts. 


Security  Program 

During  its  review,  the  Panel  also  investigated  the  physical  secur- 
ity at  Beech,  HR-Downey,  and  KSC  for  adequacy  during  the  times  the 
Apollo  13  oxygen  tank  was  in  custody  at  these  locations.  Tfie  security 
program  at  each  location  was  found  to  be  satisfactory  and  adequate  to 
provide  the  physical  protection  of  the  oxygen  tanks.  A determination 
was  made  as  a result  of  the  survey  that  no  evidence  was  discovered  that 
the  failure  of  the  oxygen  tanks  on  Apollo  13  was  the  result  of  any  will- 
ful, deliberate,  or  mischievous  act  on  the  part  of  an  individual  at  the 
facilities  surveyed . 


Safety  and  Reliability  and  Quality  Assurance 

A detailed  management  review  was  made  of  both  the  Safety  and  R&QA 
organizations  as  applicable  to  the  Apollo  CSM.  Safety  Offices  at  NASA 
Headquarters  Office  of  Manned  Space  Flight,  MSC,  and  KSC  have  safety 
responsibilities  regarding  Apollo  which  are  clearly  established  and 
implemented  by  both  Government  and  support  contractor  personnel.  Safety 
audits  by  NASA  Headquarters  teams  and  participation  by  MSC  and  KSC  per- 
sonnel in  panels,  boards,  and  program  reviews  demonstrates  continuing 
organizational  attention  to  safety.  Safety  studies  are  being  made  to 
identify  hazards  associated  with  the  Apollo  spacecraft  during  ground 
tests  and  for  each  manned  mission.  HR-Downey  has  a safety  organization 
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with  specific  responsibilities  for  the  Apollo  CSM.  The  NR  safety  func- 
tion is  integrated  into  the  Engineering,  Manufacturing,  and  Test  Opera- 
tions with  its  objectives  to  eliminate  or  control  risks  to  personnel 
and  equipment  throughout  the  manufacture,  checkout,  and  flight  missions 
of  the  Apollo  CSM.  Even  though  the  NR  safety  effort,  as  written  in  their 
Safety  Plan,  is  fragmented  over  several  organizational  units,  it  appar- 
ently is  working  effectively.  In  all  cases,  the  safety  organizations 
report  to  a sufficiently  high  organizational  level  to  provide  them  a 
desirable  independence  of  safety  surveillance. 


Failure  Reporting 

The  Panel  found  that  the  Apollo  Reliability  and  Quality  Assurance 
organizations  at  MSC,  KSC,  NR,  and  Beech  have  an  effective  independent 
failure-reporting  and  failure-correction  and  tracking  system.  Documen- 
tation from  this  system  was  observed  to  be  both  rapid  and  accurate. 

The  Reliability  Group  provides  special  studies  such  as  Failure  Modes 
and  Effects  Analysis  (FMEA),  Suspect  Flight  Anomalies  Report,  and  con- 
figuration change  tracking.  In  the  case  of  the  Apollo  15  oxygen  tank, 
a Single  Point  Failure  Summary  was  made  in  1968.  Among  the  failure  modes 
considered  was  fire  in  the  CSM  external  to  the  oxygen  tanks  which  might 
lead  to  the  loss  of  them.  This  was  considered  an  acceptable  risk  be- 
cause of  control  of  ignition  sources  and  low  probability  of  occurrence. 
Rupture  of  the  oxygen  tanks  was  also  considered  and  accepted  due  to  the 
redundance  of  the  oxygen  supply  and  low  likelihood  of  failure  occurrence. 
For  Apollo  15,  as  for  previous  missions,  a System  Safety  Assessment  was 
made  on  February  19,  1970,  as  an  additional  review  from  previous  mis- 
sions, and  it  was  concluded  that  there  were  no  open  safety  items  to 
constrain  the  Apollo  15  flight . 
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PART  E4 


MANAGEMENT  ORGANIZATION 


Relating  organizational  and  management  structures  to  an  event  of 
the  kind  now  under  consideration  is  particularly  difficult  inasmuch  as 
the  time  period  of  importance  includes  the  entire  history  of  the  Program* 
in  this  case  some  9 years,  during  which  these  structures  have  undergone 
many  significant  changes.  With  this  in  mind,  the  approach  adopted  for 
this  study  was  (l)  to  examine  and  document  what  exists  today,  (2)  to 
trace  the  history  of  events  that  might  have  had  a direct  bearing  on  the 
failure,  (3)  to  examine  the  management  inplications  of  those  specific 
events,  and  (4)  to  try  and  assess  whether  those  implications  are  still 
pertinent  to  management  as  it  exists  today  and  whether,  therefore,  cor- 
rective measures  of  any  kind  are  indicated.  To  accomplish  even  this 
limited  objective  has  required  an  early  focusing  of  attention  on  just 
those  organizations  and  functions  directly  involved,  or  potentially 
involved,  in  the  events  under  consideration.  Thus,  following  a brief 
description  of  the  overall  organizational  and  management  relationships 
applicable  to  the  Program  as  a whole,  this  report  concentrates  on  those 
organizations  responsible  for  the  particular  elements  of  the  Apollo 
spacecraft  in  which  the  failure  occurred. 


BACKGROUND  AND  PERSPECTIVE 

The  Apollo  Program  has  represented  the  largest  single  research  and 
development  program  ever  undertaken  by  the  United  States  Government;  at 
its  peak  (in  1966)  it  involved  about  300,000  persons.  The  Government- 
industry  team  responsible  for  the  Program  has  included  25  prime  contrac- 
tors and  more  than  4,000  subcontractors  and  vendors. 

In  its  simplest  terms,  the  Apollo  Program  has  two  major  objectives: 

(l)  to  develop  a vehicle  capable  of  landing  men  on  the  surface  of  the 
Moon  and  returning  them  safely  to  the  surface  of  the  Earth,  and  (2)  to 
operate  that  vehicle  in  an  initial  series  of  manned  lunar  landing  missions. 
These  two  objectives  have,  in  a gross  sense,  dictated  the  major  division 
of  responsibilities  among  NASA  organizations  in  the  management  of  the 
Apollo  Program.  With  overall  responsibility  vested  in  the  NASA  Head- 
quarters organization,  responsibility  for  producing  the  vehicle  was 
assigned  to  two  NASA  field  installations: 

1.  For  the  spacecraft,  to  the  Manned  Spacecraft  Center,  Houston, 

Texas . 

2.  For  the  launch  vehicle,  to  the  Marshall  Space  Flight  Center, 
Huntsville,  Alabama. 
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The  responsibility  for  operating  the  vehicle  in  the  series  of 
flight  missions  which  constituted  the  second  objective  was  also  assigned 
to  two  field  installations: 

1.  For  launching  the  space  vehicle,  to  the  Kennedy  Space  Center, 
Cape  Kennedy,  Florida. 

2.  For  all  postlaunch  operations,  to  the  Manned  Spacecraft  Center, 
Houston,  Texas. 

These  two  major  objectives  also  serve  to  classify  the  two  major 
time  periods  into  which  the  9-year  history  of  the  Program  can  be 
divided.  Thus,  the  first  7 years,  from  1961  to  1968,  constituted  the 
development  stage  of  the  Program  in  which  all  components  of  the  space 
vehicle,  supporting  equipment,  and  operational  facilities  were  designed, 
developed,  manufactured  and  tested;  the  last  2 years,  from  1968  to  the 
present,  have  constituted  the  beginning  of  the  "operations"  stage  of 
the  Program,  with  two  successful  manned  lunar  landing  missions  already 
• The  significance  of  distinguishing  between  these  two  periods 
of  time  lies  in  the  inevitable  shift  of  emphasis  that  accompanied  the 
transition  between  the  two  from  engineering  problems  to  operational 
problems . 


NASA  - APOLLO  MANAGEMENT  ORGANIZATION 

Two  classical  approaches  to  project  management  were  available  to 
NASA  when  the  Apollo  Program  began  in  1961.  The  first  approach,  often 
used  by  Government  and  the  aircraft  industry  in  the  early  years  of  air- 
craft development,  would  place  in  a single  organization  and  under  the 
total  control  of  the  project  manager  all  of  the  skills  and  specialities 
required  to  manage  the  project.  Thus,  the  project  organization  would 
provide  for  itself  all  the  support  necessary  in  engineering,  procurement, 
program  control,  financial  management,  reliability  and  quality  assurance, 
etc.,  and  would  operate  virtually  independently  of  the  institutional  or- 
ganization of  which  it  was  a part.  The  second  approach,  which  was  rapidly 
gaining  acceptance  during  the  1940’ s and  1950’s,  was  the  so-called  "ma- 
trix concept  in  which  skeletal  project  management  organizations  were 
superimposed  on  an  institutional  organization  containing  elements  and 
subelements  in  all  of  the  specialities  needed  by  the  projects.  Thus 
the  institutional  organization  would  provide  the  basic  capabilities 
required  by  the  projects  in  engineering,  procurement,  program  control, 
etc.,  and  the  project  managers  would  draw  upon  those  as  required.  The 
advantages  of  this  approach  for  multi-project  organizations  are  apparent. 
Costly  duplication  of  support  activities  is  minimized,  the  overall  effi- 
ciency of  manpower  utilization  is  maximized,  and  the  quality  of  support 
provided  is  enhanced  by  consolidation. 
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NASA  adopted  the  matrix  approach  to  project  management  for  the 
Apollo  Program.  In  NASA  Headquarters,  and  in  each  of  the  three  princi- 
pal NASA  field  centers  involved,  Apollo  Program  Offices  were  established 
from  which  virtually  all  of  the  direction  for  conduct  of  the  Program 
has  emanated.  At  each  location,  however,  these  Program  Offices  are 
essentially  management  organizations  and  depend  heavily  on  the  line 
elements  of  the  host  institution's  organization  for  support.  Continuity 
in  lines  of  authority  between  the  Apollo  Program  Director  in  Headquarters 
and  the  Apollo  Program  organization  in  the  field  has  been  assured  through 
the  delegation  by  each  Center  Director  to  his  Apollo  Program  Manager  of 
full  authority  for  conduct  of  that  Center's  part  of  the  Program.  Thus, 
for  purposes  of  program  direction  and  authority,  there  exists  throughout 
the  Agency  a single  pyramidal  management  structure  cutting  across 
institutional  lines  and  tying  together  all  elements  of  the  Apollo  Program 
organization.  This  relationship  is  illustrated  in  figure  E4-1. 

The  organizations  of  the  principal  NASA  institutions  involved  in 
the  Apollo  Program  are  illustrated  in  figures  E4-2  through  E4-6,  in 
which  the  locations  of  offices  with  primary  responsibility  for  Apollo 
are  indicated  by  heavy  lines. 


NASA  Headquarters  Organization 

The  Associate  Administrator  for  Manned  Space  Flight,  who  heads  the 
Office  of  Manned  Space  Flight,  is  the  Administrator's  executive  agent 
for  the  general  management  of  all  manned  space  flight  programs.  His 
authority  flows  directly  from  the  Administrator  and  is  broad,  covering 
all  aspects  of  all  manned  space  flight  programs.  He  also  exercises 
institutional  line  authority  over  the  three  manned  space  flight  field 
centers  which  report  directly  to  him. 


Office  of  Manned  Space  Flight  Organization 

Figure  E4-2  shows  the  organizational  structure  within  the  Headquarters 
Office  of  Manned  Space  Flight.  The  Associate  Administrator  for  Manned 
Space  Flight  has  assigned  the  responsibility  for  management  of  all 
aspects  of  the  Apollo  Program  to  the  Apollo  Program  Director,  and  has 
delegated  to  him  full  authority  to  carry  out  that  responsibility.  The 
Apollo  Program  Director  is  the  highest  Agency  official  whose  responsi- 
bility is  exclusively  for  the  Apollo  Program.  There  are  counterpart 
Program  Directors  for  other  manned  space  flight  programs  with  similar 
responsibilities  to  their  own  programs,  and  there  are  a number  of  func- 
tional offices  which,  consistent  with  the  matrix  management  concept, 
provide  support  to  all  on-going  programs.  Shown  also  in  figure  E4-2 
are  the  direct  lines  of  program  authority  between  the  Apollo  Program 
Director  and  his  subordinate  program  managers  in  the  three  field  centers. 
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Figure  E4-1.-  NASA  Apollo  Program  organization. 
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Figure  Elt-2.-  Office  of  Manned  Space  Flight  organization. 


Manned  Spacecraft  Center  (MSC) 

The  organization  of  the  Manned  Spacecraft  Center  is  shown  in  fig- 
ure E4-3.  The  permanent  functional  organizations  are  represented  by  the 
five  technical  directorates  (Engineering  and  Development,  Science  and 
Applications,  Medical  Research  and  Operations,  Flight  Crew  Operations, 
and  Flight  Operations)  and  the  institutional  Directorates  and  Staff 
Offices  (e.g.,  Administration,  Program  Control  and  Contracts,  Public 
Affairs,  Legal,  etc.)-  The  program  management  organizations  presently 
include  the  Apollo  Spacecraft,  Skylab,  and  Space  Shuttle  Program  Offices, 
and  the  Advanced  Missions  Program  Office,  which  is  responsible  for  studies 
and  planning  potentially  leading  to  new  flight  programs. 

Responsibility  for  managing  all  aspects  of  the  Apollo  Program  as- 
signed to  the  Center  is  vested  in  the  Manager  of  the  Apollo  Spacecraft 
Program  Office  (ASPO).  Under  the  matrix-management  concept,  a rela- 
tively small  percentage  of  the  Center's  staff  directly  employed  in  the 
Apollo  Program  reports  to  him  organizationally.  Virtually  all  of  the 
Apollo  tasks  done  in-house  at  MSC  (component  testing,  instrumentation 
development,  flightcrew  training,  operations  planning,  etc.)  are  per- 
formed by  the  Center's  line  organizations  (the  functional  Directorates) 
under  the  overall  direction  and  coordination  of  the  ASPO  Manager. 


Marshall  Space  Flight  Center  (MSFC) 

This  Center  is  responsible  for  the  development,  manufacture , and 
testing  of  the  launch  vehicles  used  in  the  Apollo  Program.  The  organi- 
zation of  the  Center  is  shown  in  figure  E4-4.  As  at  MSC,  this  Center 
employs  the  matrix-management  concept  in  which  the  basic  organization, 
represented  by  the  Program  Development,  Science  and  Engineering,  and 
Administration  and  Technical  Services  Directorates,  is  functional  and 
the  program-management  organization,  represented  by  the  Program  Manage- 
ment Directorate,  is  made  up  of  program  offices  for  individual  launch 
vehicles  or  stages. 

Although  the  Saturn  Program  Office  represents  the  Apollo  Launch 
Vehicle  Program  Office  for  purposes  of  full-time  management,  the  Director 
of  Program  Management  has  been  designated  the  Apollo  Launch  Vehicle  Pro- 
gram Manager.  He  manages  and  directs  all  aspects  of  the  Apollo  Program 
assigned  to  MSFC,  drawing  on  technical  support  from  the  Science  and 
Engineering  Directorates. 


Kennedy  Space  Center  (KSC) 

The  KSC  responsibility  in  the  Apollo  Program  includes  the  assembly, 
checkout,  and  launch  of  the  space  vehicle. 


E-18 


E-19 


Figure  El|-3*  - Manned  Spacecraft  Center  organization. 


DEPUTY 

DIRECTOR, 

MANAGEMENT 


e-;>o 


Figure  Ek-k.-  Marshall  Space  Flight  Center  organization. 


The  organization  of  the  Center  is  shown  in  figure  E4-5.  Again  the 
basic  organization  is  functional,  consisting  of  those  major  operational 
activities  necessary  to  the  launch  of  all  space  vehicles.  The  program- 
management  organization  is  similar  to  that  at  MSC  and  is  made  up  of  an 
individual  program  office  for  each  active  flight  program.  Overall  re- 
sponsibility for  managing  all  aspects  of  the  preparation,  checkout,  and 
launch  of  the  Apollo  space  vehicles  is  assigned  to  the  Manager  of  the 
Apollo  Program  Office  (APO).  All  functional  organizations  at  the  Center 
participate  in  those  activities  under  the  overall  direction  of  the  APO 
Manager.  Direct  responsibility  for  launch  and  checkout  is  delegated  to 
the  Director  of  Launch  Operations. 


CONTRACTOR  ORGANIZATIONS 


The  oxygen  tank  in  which  the  failure  occurred  was  a component  of 
the  cryogenic  gas  storage  subsystem  (CGSS) , which  'Serves  both  the 
electrical  power  system  (EPS)  and  the  environmental  control  system  (ECS) 
of  the  spacecraft  service  module  (SM).  The  contractors  and  contractual 
relationships  involved  in  the  manufacture  of  the  tank  are  illustrated  in 
figure  E4-6.  North  American  Rockwell  (formerly  North  American  Aviation), 
prime  contractor  for  the  command  and  service  modules  (CSM) , subcontracted 
with  Beech  Aircraft  Corporation  for  manufacture  of  the  CGSS.  Beech,  in 
turn,  purchased  certain  parts  for  the  subsystem  from  the  three  vendors 
shown:  the  oxygen  pressure  vessel  (inner  tank)  from  Airite  Products 

Division  of  the  Electrada  Corporation;  the  oxygen  quantity  and  temperature 
sensor  probe  from  Simmonds  Precision  Products,  Inc.;  and  the  fan  motors 
from  Globe  Industries,  Inc.  Pertinent  organization  charts  for  North 
American  Rockwell  and  Beech  Aircraft  are  shown  in  figures  E4-7  through 
E4-11.  The  organizations  of  the  vendor  companies  were  not  considered 
pertinent  and  are  not  shown. 


North  American  Rockwell  (NR) 

The  Apollo  CSM  contract  is  held  by  the  Space  Division  of  North 
American  Rockwell  and  the  organization  of  that  Division  is  shown  in 
figure  e4-7.  North  American  Rockwell  also  applies  the  matrix-management 
concept  in  their  current  organization  with  program  offices  (Saturn  S-II, 
Space  Station,  CSM,' Space  Shuttle,  etc.)  superimposed  on  a basically 
functional  organizational  structure  which  includes  Manufacturing, 
Research,  Engineering,  and  Test;  Material;  Quality  and  Reliability 
Assurance;  and  the  conventional  administrative-support  functions.  The 
Apollo  contract  is  managed  for  NR  by  the  CSM  Program  Office  headed  by 
a division  vice  president.  Figure  E4-8  shows  the  organization  of  that 
Office.  Within  the  CSM  Program  Office  the  principal  suborganization 
for  program  management  is  Engineering,  headed  by  an  Assistant  Program 
Manager  and  Chief  Program  Engineer.  On  the  functional  side  of  the  Space 
Division,  referring  again  to  figure  E4-7,  line  responsibility  for 
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Figure  EU-5--  Kennedy  Space  Center  organization. 
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Figure  E U-6.-  Croygenic  gas  storage  subsystem-contractual  relationships. 
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Figure  E^-8.-  North  American  Rockwell,  Space  Division,  CSM  Programs  Office  organization. 


performance  (as  opposed  to  management)  under  the  Apollo  contract  falls 
under  the  functional  support  organization  for  Research,  Engineering,  and 
Test,  also  headed  by  a division  vice  president.  The  organization  of  that 
Office  is  along  systems/subsystems  lines.  At  the  subsystem  level,  the 
engineer  in  charge  in  this  organization  also  acts  as  the  subsystem 
manager  for  the  program  management  organization,  in  a manner  quite 
analogous  to  the  technique  used  by  the  MSC  organization  described  ear- 
lier. The  relationship  at  North  American  Rockwell  is  illustrated  in 
figure  E4-9. 


North  American  Launch 
Operations  Space  Division  (KSC) 

All  NR  CSM  operations  at  KSC  are  conducted  in  accordance  with  the 
provisions  of  Supplement  KSC-1  to  MSC  contract  no.  NAS9-150  with  NR. 

The  Supplement  contains  a statement  of  work  prepared  by  KSC  and  KSC  is 
responsible  for  technical  direction  to  the  NR  personnel.  The  NR  Apollo 
CSM  Operations  at  KSC  supports  KSC  in  CSM  checkout  and  launch  and  is  a 
part  of  the  NR  Launch  Operations  Space  Division  under  the  NR  Vice  Pres- 
ident and  General  Manager  who  is  located  at  Cocoa  Beach,  Florida.  He, 
in  turn,  reports  to  the  Space  Division  President,  NR. 


Beech  Aircraft  Corporation 

The  subcontract  from  North  American  Rockwell,  for  manufacturing  of 
the  cryogenic  gas  storage  subsystem,  is  held  by  the  Boulder  Division  of 
the  Beech  Aircraft  Corporation.  The  organization  of  that  Division  is 
shown  in  figure  E4-10.  Beech  also  uses  the  matrix-management  concept 
with  management  responsibility  for  the  Apollo  subsystem  contract  vested 
in  the  Apollo  Program  Manager  and  performance  responsibility  in  the 
Manager,  Engineering.  Figure  E4-11  shows  the  breakdown  of  management 
responsibilities  within  the  office  of  the  Apollo  Program  Manager. 
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Figure  E^-9.-  North  American  Rockwell  organizational  relationships  applicable 

to  cryogenic  gas  storage  subsystem. 
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Figure  E4-11,-  Beech  Aircraft  Corporation,  Boulder  Division 
Apollo  Program  Office  organization. 
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PART  E5 


RESPONSIBILITIES  AND  OPERATING  RELATIONSHIPS 


The  specific  responsibilities  assigned  to  most  of  the  NASA  organi- 
zational elements  involved  in  management  of  the  Apollo  Program  are 
described  in  some  detail  in  the  series  of  documents  titled  NASA-Apollo 
Program  Management.  Where  those  descriptions  are  still  pertinent,  they 
are  incorporated  here  by  reference  or  are  paraphrased  as  necessary  to 
maintain  the  continuity  of  this  document.  The  following  discussion  is, 
for  the  most  part,  confined  to  those  organizations  and  responsibilities 
that  are  germane  to  the  present  study. 


NASA  ADMINISTRATOR 


The  Administrator  of  NASA  reserves  to  his  own  office  the  authority 
for  establishing  and  enforcing  Agency  policy,  for  establishing  overall 
program  policy  and  objectives,  for  approving  mission  plans  and  schedules, 
for  mission  funding  and  major  procurement  actions,  and  for  insuring  ad- 
herence to  functional  management  policies.  Apollo  Program  policies, 
objectives,  and  management  systems  are  reviewed  and  approved  by  the 
Administrator,  as  are  significant  schedule  and  budget  decisions.  Man- 
agement directives  relating  to  the  Program  are  issued  within  the 
Agency-wide  NASA  Issuance  System,  with  special  provisions  for  specific 
instructions  and  directives  to  be  issued  by  the  Apollo  Program  Director 
to  participating  program  elements  in  the  Manned  Space  Flight  Field 
Centers . 


ASSOCIATE  ADMINISTRATOR  FOR  MANNED  SPACE  FLIGHT 


As  described  earlier,  the  Associate  Administrator  for  Manned  Space 
Flight,  serving  as  the  Administrator’s  executive  agent  for  the  general 
management  of  all  manned  space  flight  programs,  shares  full  responsi- 
bility with  the  Administrator  for  all  aspects  of  these  programs.  In 
this  capacity,  he  is  advised  by  three  major  policy  bodies:  the  Manned 

Space  Flight  Management  Council,  the  Science  and  Technology  Advisory 
Committee,  and  the  Manned  Space  Flight  Experiments  Board.  The  respon- 
sibilities of  these  groups  are  summarized  as  follows. 
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Manned  Space  Flight  Management  Council 

The  Council  consists  of  the  Associate  Administrator  for  Manned 
Space  Flight  as  Chairman  and  the  Directors  of  the  three  Manned  Space 
Flight  Centers.  The  Associate  Administrator  for  Manned  Space  Flight 
establishes  program  policy  guidelines  and  program  plans  in  consultation 
with  the  Council.  For  the  Apollo  Program,  the  Council  reviews  policy, 
progress,  and  performance  to  assure  that  goals  are  being  met,  that 
technical  problems  are  being  dealt  with  properly,  and  that  adequate 
resources  are  available  for  conduct  of  the  planned  program.  The 
Council  also  acts  as  the  Design  Certification  Board  in  examining  the 
entire  Program  for  proof  of  development  maturity  prior  to  each  manned 
flight  of  a new  configuration.  To  insure  flightworthiness  and  manned 
flight  safety,  the  Council  assesses  the  design  of  the  space  vehicle 
launch  complex,  the  Mission  Control  Center,  the  Manned  Space  Flight 
Network,  and  the  launch  instrumentation  for  manned  Apollo  missions.  A 
Mission  Design  Certification  Document,  executed  by  the  entire  member- 
ship of  the  Council,  serves  as  the  approval  authority  for  proceeding 
with  specific  flight  missions  designated  for  manned  flight. 


Science  and  Technology  Advisory  Committee 

The  Committee  is  made  up  of  leading  scientists  and  engineers  from 
universities,  industry,  and  Government.  The  Committee  functions  in  an 
advisory  capacity  to  the  Associate  Administrator  for  Manned  Space  Flight 
on  major  technical  and  scientific  questions.  They  perform  independent 
evaluations  and  make  recommendations  to  the  Associate  Administrator  for 
Manned  Space  Flight . 


Manned  Space  Flight  Experiments  Board 

The  Board  consists  of  the  Associate  Administrator  for  Manned  Space 
Flight  as  Chairman,  the  Associate  Administrators  for  Space  Science  and 
Applications  and  for  Advanced  Research  and  Technology,  and  representa- 
tives from  the  Department  of  Defense  and  the  Air  Force.  The  Board* s 
responsibility  is  to  advise  and  recommend  to  the  Associate  Administrator 
for  Manned  Space  Flight  which  experiments  should  be  included  in  manned 
space  flight  missions. 


APOLLO  PROGRAM  DIRECTOR 


Full  responsibility  and  authority  for  managing  all  aspects  of  the 
Program  within  the  constraints  of  budget,  schedule,  and  performance 
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approved  by  the  Administrator  are  delegated  to  the  Apollo  Program  Direc- 
tor by  the  Associate  Administrator  for  Manned  Space  Flight.  It  is  the 
Program  Director1 s responsibility  to  define  or  approve  mission  require- 
ments, technical  requirements,  program  specifications,  and  reliability, 
quality  assurance,  and  safety  standards.  His  office  is  organized  into 
the  five  functional  Directorates  shown  in  figure  E5-1 . The  Apollo 
Program  Offices  in  the  three  Manned  Space  Flight  Centers  have  organiza- 
tional structures  similar  to  that  of  the  Program  Director's,  thus 
providing  parallel  responsibilities  for  managers  at  the  two  levels.  The 
responsibilities  of  four  of  the  five  Directorates  in  the  Apollo  Program 
Office  are  described  in  the  following  paragraphs. 


Test  Directorate 

The  Test  Directorate  is  responsible  for  planning  and  coordinating 
development  of  test  programs  for  all  phases  of  design,  manufacture,  and 
checkout  of  launch  vehicles,  spacecraft,  experiment  hardware,  and  ground 
support  equipment.  The  Directorate  coordinates  requirements  for  test 
facilities,  and  prepares  and  justifies  budget  requests  for  test  programs 
and  facilities. 


Operations  Directorate 

The  Operations  Directorate  is  responsible  for  operations  plans  and 
schedules;  operations  documentation ; mission  test  plans;  flight  plans; 
trajectory  design  and  analysis;  crew  operations  and  training;  premission 
operations  checkout,  mission  safety,  and  hazard  probabilities;  and 
mission  operations  support. 


Systems  Engineering  Directorate 

The  Systems  Engineering  Directorate  is  responsible  for  developing 
the  Apollo  Program  Specifications;  developing  flight  mission  assign- 
ments (including  mission  objectives  and  overall  flight  profiles);  re- 
viewing program  to  define  technical  interfaces;  establishing  control 
weights  for  vehicle  stages  and  spacecraft  modules;  and  verifying  that 
system  performance  requirements  are  achieved. 


Program  Control  Directorate 

The  Program  Control  Directorate  is  responsible  for  integrated  plan- 
ning; preparation  of  Program  Development  Plans;  maintaining  interrelated 
schedules;  logistics;  specifications;  performance  analysis  and  control 
system  management;  configuration  management;  data  management  systems; 
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Figure  E5-1.-  Functional  organization  of  the  Apollo  Program  Office, 

NASA  Headquarters. 


preparation  of  budget  and  cost  information;  and  operation  of  the  Apollo 
Action  Center. 


Reliability  and  Quality  Assurance  (R&QA)  Directorate 

The  R&QA  Directorate  is  responsible  for  initiating  program-wide 
R&QA  policies  and  procedures;  preparing  program  development  plans  for 
the  Manned  Space  Flight  Centers;  developing  R&QA  training  programs; 
establishing  R&QA  reporting  requirements;  and  evaluating  the  effective- 
ness of  R&QA  programs  in  the  Centers. 


Support  Contractors 

The  Apollo  Program  Director  also  has  the  services  of  three  support 
contractors  available  to  him: 

1.  Bellcomm,  Inc.  (AT&T),  which  provides  systems  engineering  sup- 
port consisting  of  studies,  technical  evaluations,  analytical  investi- 
gations, and  technical  consulting  services. 

2.  The  Boeing  Company,  Space  Division,  which  performs  the  techni- 
cal integration  and  evaluation  function  for  the  Program  Director.  This 
includes  analyses  and  evaluation  of  program  management , interface  con- 
trol , configuration  management,  logistics,  engineering,  manufacturing, 
testing,  launch  operations,  and  information  systems. 

3.  General  Electric  Company,  Apollo  Systems  Development,  which 
provides  general  engineering  support , including  data  management , 
management  information  systems , and  R&QA  investigations . 


MSC  APOLLO  SPACECRAFT  PROGRAM  OFFICE  (ASPO) 


As  in  the  Headquarters  organization,  the  Apollo  Spacecraft  Program 
Manager  at  MSC  acts  for  the  MSC  Center  Director  as  general  manager  of 
all  Apollo-related  activities  at  the  Center.  In  that  capacity  he  is 
the  official  technical  interface  between  NASA  and  the  spacecraft  con- 
tractors. He  is  responsible  for  managing  the  accomplishment  of  all 
Apollo  tasks  at  the  Center,  even  though  many  of  those  tasks  are  per- 
formed by  Center  personnel  not  organizationally  responsible  to  him. 

His  functional  responsibilities  essentially  parallel  those  of  the 
Apollo  Program  Director,  but  are  applicable  to  the  spacecraft  only 
while  those  of  the  Program  Director  encompass  all  aspects  of  the  Program. 
His  Program  Office  organization  is  also  essentially  parallel  to  that  of 
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the  Program  Director's,  as  shown  in  figure  E5-2.  He  has  delegated  to 
three  subordinate  Managers  (for  the  CSM,  the  LM,  and  Experiments  and 
GFE)  the  following  responsibilities: 

1.  Directing  the  design,  development,  and  fabrication  programs 
carried  out  by  the  contractors. 

2.  Directing  and  planning  systems  engineering  and  systems  inte- 
gration functions,  including  review  of  engineering  design  and  systems 
engineering  studies  conducted  by  the  contractors. 

3-  Developing  the  ground-  and  flight-test  programs  to  be  conducted 
at  White  Sands , MSC , and  KSC . 

U.  Monitoring  contractor  operations  to  assure  adherence  to  speci- 
fications and  to  identify  and  solve  problems  in  the  development  and 
fabrication  of  systems  and  subsystems. 

5.  Chairing  the  Configuration  Control  Board  (Level  3). 


Assistant  Program  Manager  for  Flight  Safety 

There  is  also  within  the  Apollo  Spacecraft  Program  Office  an  Assist- 
ant Program  Manager  for  Flight  Safety,  whose  responsibility  is  to  assure 
that  the  policies  and  procedures  of  MSC's  Safety  Office  are  adhered  to 
in  all  Apollo  Program  activities  relating  to  the  spacecraft.  He  is  the 
Apollo  Spacecraft  Program  Manager's  Safety  representative  to  KSC  and 
the  spacecraft  contractors.  He  oversees  all  program  activities  from  a 
flight  safety  viewpoint  and  is  an  advisor  to  the  Program  Manager  on 
the  flightworthiness  of  all  systems. 


Systems  Engineering  Division 

Referring  again  to  figure  E5-2,  there  are  six  functional  divisions 
reporting  to  the  Apollo  Spacecraft  Program  Manager.  Two  of  these  per- 
form functions  that  have  a direct  bearing  on  the  development  and  manu- 
facture of  the  cryogenic  gas  storage  subsystem.  The  Systems  Engineering 
Division  is  responsible  for  the  coordination  and  control  of  the  design 
and  development  of  all  spacecraft  systems.  The  Division  determines  the 
technical  requirements,  and  develops  technical  specifications  (with  the 
contractor)  for  systems  and  subsystems,  and  is  responsible  for  assuring 
that  all  program  elements  (crew,  hardware,  and  software)  are  successfully 
integrated  into  each  system  design.  This  Division  plays  its  major  role 
during  the  design  and  development  stage  of  the  spacecraft  and  its 
systems.  It  is  responsible  for  organizing  and  conducting  all  Prelimi- 
nary Design  Reviews  and  Critical  Design  Reviews.  It  is  also  responsible 
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Figure  E5-2--  Functional  organization  of  the  Apollo  Spacecraft  Program. 


for  definition  and  implementation  of  the  nonmetallic  materials  program. 
Mission  definition  and  planning  are  also  major  responsibilities. 


CSM  Project  Engineering  Division 

This  Division,  which  has  counterpart  Divisions  for  the  LM  and  for 
Experiments  and  GFE,  plays  its  major  role  during  manufacture  and  test 
of  the  spacecraft.  From  this  Division  two  engineers,  designated  as 
Project  Engineers,  are  assigned  to  each  spacecraft  as  it  begins  manu- 
facture. The  Project  Engineers  are  the  Program  Manager's  representatives 
for  his  particular  spacecraft  and  are  responsible  for  assuring  that  that 
particular  spacecraft  is  ready  for  launch  on  schedule,  that  it  has  suc- 
cessfully passed  all  tests,  inspections,  and  reviews,  and  that  all  asso- 
ciated ground  support  equipment  is  on  schedule.  Their  responsibility 
extends  up  to  launch  and  resumes  after  recovery  for  postflight  testing. 


Resident  Apollo  Spacecraft  Program  Offices  (RASPO) 

There  are  Resident  Apollo  Spacecraft  Program  Managers  at  the  North 
American  Rockwell  plant,  Downey,  California  (for  the  CSM  prime  contract), 
at  Bethpage,  New  York  (for  the  LM  prime  contract),  and  at  the  Kennedy 
Space  Center  (for  launch  activities).  The  Managers  of  the  RASPO-Downey 
and  the  RASPO-Bethpage  act  for  the  Apollo  Spacecraft  Program  Manager  in 
n.l  1 spacecraft  activities  taking  place  at  their  locations.  Their  re- 
sponsibilities encompass  program  control,  manufacture,  test  and  checkout, 
and  configuration  management.  The  Manager  at  the  RASPO-Kennedy  repre- 
sents the  Apollo  Spacecraft  Program  Manager  in  all  operations  at  KSC 
which  relate  to  the  spacecraft.  Specific  responsibilities  include: 

1.  Liaison  with  the  KSC  Spacecraft  Operations  Director  on  all 
matters  relating  to  spacecraft  preparation  and  checkout  for  launch. 

2.  Submission  to  KSC  of  MSC ' s prelaunch  test  and  checkout  require- 
ments for  the  spacecraft. 

3.  Approval  of  KSC's  Test  and  Checkout  Plans. 

4.  Approval  of  waivers  and  deviations  to  MSC's  test  and  checkout 
requirements . 

5.  Restricted  change  approval  related  to  GSE  and  test  operations. 


MSC  RELIABILITY  AND  QUALITY  ASSURANCE  (R&QA)  OFFICE 


The  R&QA  Office  at  MSC  is  an  independent  functional  office  reporting 
to  the  Director  of  the  Center  and  responsive  to  the  ASPO.  It  has  over- 
all responsibility  for  planning,  coordinating,  and  directing  all  R&QA 
activities  at  the  Center.  Specific  responsibilities  include: 

1.  Establishing  reliability,  quality,  and  inspection  requirements 
and  criteria  for  spacecraft,  systems,  subsystems,  and  supporting 
equipment . 

2.  Insuring  implementation  of  R&QA  requirements  and  criteria  at 
contractor  plants  and  at  MSC. 

3.  Developing  MSC  engineering  design  standards  and  criteria. 

L.  Establishing  certification  test  criteria  and  approving  certi- 
fication test  plans  and  reports. 

5.  Establishing  and  enforcing  policies  governing  parts  and  materials 
identification,  usage,  and  qualification  information  for  critical  space- 
craft hardware. 


MSC  SAFETY  OFFICE 


The  Safety  Office  at  MSC  is  also  an  independent  functional  office, 
reporting  to  the  Center  Director.  It  is  responsible  for  establishing 
safety  policies,  standards,  and  procedures  in  the  fields  of  industrial 
operations  and  manned  space  flight.  Specific  responsibilities  include: 

1.  Review  and  evaluation  of  the  safety  of  operations  in  all  Center 
organizations . 

2.  Advising  the  Center  Director  and  Center  Management  on  all 
matters  relating  to  industrial  and  flight  safety. 

3.  Reviewing  and  evaluating  the  effectiveness  of  contractor 
safety  programs  against  MSC  safety  standards  and  criteria. 


E-39 


MSC  ENGINEERING  AND  DEVELOPMENT  DIRECTORATE 


The  Engineering  and  Development  Directorate  is  the  principal  en- 
gineering component  of  the  Center  functional  organization.  This 
Directorate,  organized  into  Divisions  by  technical  discipline,  conducts 
most  of  the  Center* s supporting  research  and  technology,  develops  con- 
cepts for  advanced  systems,  and  provides  technical  support  to  all  on- 
going flight  programs.  This  support  roughly  subdivides  into  three 
major  categories: 

1.  Systems  analyses  and  definition  of  new  techniques  applicable 
to  space  flight  programs . 

2.  Subsystem  and  component  tests. 

3.  Technical  management  of  the  design,  manufacture,  and  testing 
of  subsystems  by  the  Program  contractors. 

This  latter  function  represents  a major  element  of  the  Apollo 
Program  management  system  and  is  described  as  follows: 

The  three  subordinate  Managers  in  the  ASPO  (for  CSM,  LM,  and  Experi- 
ments and  GFE)  rely  heavily  on  the  matrix  management  concept  for  carry- 
ing out  their  responsibilities.  They  receive  technical  support  from 
subsystem  managers  appointed  from  the  technical  Directorates  of  the 
Center’s  line  organization.  There  are  between  ho  and  50  subsystem  mana- 
gers, most  of  them  located  in  the  Engineering  and  Development  Directorate 
(fig.  EU-H).  The  Subsystem  Manager  for  the  cryogenic  gas  storage  sub- 
system is  organizationally  located  in  the  Propulsion  and  Power  Division 
of  that  Directorate.  These  managers  remain  assigned  to  their  permanent 
organizations,  but  assume  program  responsibility  for  the  design,  develop- 
ment, and  manufacture  of  particular  subsystems.  In  this  role  they  report 
to  the  Module  Manager  (e.g.,  Manager  for  the  CSM)  in  the  Program  Office. 
For  all  other  purposes  they  report  through  normal  organizational  lines. 
The  subsystem  manager’s  responsibility  for  his  subsystem  is  continuous 
from  preliminary  design  through  operations.  He  is  the  Program  Office’s 
technical  manager  of  all  work  done  on  the  subsystem  (although  contractor 
direction  is  given  through  the  Project  Officer  or  Contracting  Officer) 
and  is  responsible  for  assuring  that  the  subsystem  is  built  on  schedule, 
within  budget,  and  to  specifications. 
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KSC  APOLLO  PROGRAM  MANAGER 


The  Apollo  Program  Manager  at  KSC  represents  the  Center  Director 
in  all  matters  relating  to  the  launch  of  an  Apollo  space  vehicle.  He 
develops  all  necessary  plans  for  work  to  be  accomplished  at  KSC  for 
the  Apollo  Program  and  issues  "requirements"  to  the  line  organizations 
of  the  Center.  The  line  organizations  then  assume  full  responsibility 
for  conducting  their  parts  of  the  Program,  and  the  role  of  the  Apollo 
Program  Manager  becomes  one  of  monitoring,  assessing,  and  modifying 
requirements  as  necessary.  The  organization  of  the  KSC  Apollo  Program 
Office  is  shown  in  figure  E5-3- 


KSC  DIRECTOR  OF  LAUNCH  OPERATIONS 


This  organization  has  the  principal  functional  responsibility  for 
conducting  the  launch  of  the  Apollo  space  vehicle.  The  Director  of 
Launch  Operations  is  responsible  for  the  management  and  technical  di- 
rection of  preflight  operation  and  integration,  assembly,  test,  check- 
out, and  launch  of  all  space  vehicles.  He  initiates,  supervises,  and 
coordinates  the  preparation  of  preflight  and  launch  operations  test 
plans  and  assures  their  effective  execution.  He  assists  the  Apollo 
Program  Manager  in  negotiating  test  and  operational  sequences,  methods 
and  standards  with  the  two  development  Centers  (MSC  and  MSFC). 


INTER-CENTER  RELATIONSHIPS 


Because  the  day-to-day  management  of  the  Apollo  Program,  from 
design  through  launch,  requires  close  coordination  of  activities  under 
way  at  three  field  Centers  and  in  NASA  Headquarters,  formally  docu- 
mented Inter-Center  Agreements  have  been  drawn  to  specify  how 
responsibilities  are  divided  and  how  the  activities  at  each  location 
relate  to  those  at  the  others.  Additionally,  a series  of  Inter-Center 
Coordination  Panels  has  been  established  which  recommend  solutions  to 
technical  interface  problems  involving  the  responsibilities  of  two  or 
more  Centers.  There  are  eight  such  panels,  covering:  Crew  Safety, 

Electrical,  Flight  Evaluation,  Mechanical,  Instrumentation  and  Commu- 
nications, Flight  Mechanics,  Launch  Operations,  and  Flight  Operations. 
All  panels  operate  under  the  cognizance  of  a Panel  Review  Board  made 
up  of  representatives  from  the  three  Manned  Space  Flight  Centers  and 
the  Headquarters  Office  of  Manned  Space  Flight. 
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Figure  E5-3.-  Functional  organization  of  the  Apollo  Program  Office  at  KSC. 


Apollo  Program  Directive  No.  35A,  issued  in  August  1968,  defines 
in  considerable  detail  the  responsibilities  of  each  of  the  three  Centers 
in  the  Apollo  Program.  It  is  reproduced  on  the  following  pages  in  its 
entirety  for  reference. 
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APOLLO  PROG  HAM  DIRECTOR 


SUBJECT:  Center  Responsibilities  in  the  Apollo  Program 

OFFICE  OF  PRIME  RESPONSIBILITY:  MAP 


I.  PURPOSE 


The  purpose  of  this  Directive  is  to  assign  responsibility 
and  functions  and  define  inter-Center  relationships  for 
the  conduct  of  the  Apollo  Program. 

II.  SCOPE 


This  Directive  assigns  responsibilities  and  functions  to  MSP 
Centers  for  accomplishment  of  the  Apollo  Program  3n  amplifi- 
cation of  and  in  consonance  with  NMI  1142.1  Functions  and 
Authority  - Manned  Spacecraft  Center,  NMI  1142.3  Functions 
and  Authority  - George  C.  Marshall  Space  Flight  Center,  and 
NMI  1142.2  Functions  and  Authority  - John  F.  Kennedy  Space 
Center. 


III.  RESPONSIBILITY 


A.  The  Director  of  the  Manned  Spacecraft  Center  is  responsible 
for  design,  development,  fabrication,  qualification, 
acceptance  test  and  delivery  of  Apollo  spacecraft;  associ- 
ated ground  support  equipment  and  assigned  experiments;  for 
the  planning  of  all  Apollo  Missions;  for  the  control  of  the 
flight  phase  of  Apollo  Missions  including  the  development  of 
ground  equipment  necessary  for  mission  control  and  not  pro- 
vided by  other  centers  in  the  execution  of  their  missions; 
for  the  selection,  training  and  assignment  of  flight  crews; 
for  the  development  of  software  as  needed  for  spacecraft 
guidance,  checkout,  and  mission  control;  for  establishing 
prelaunch  requirements  for  test,  checkout  and  inspection  of 
Apollo  spacecraft;  and  for  the  planning  and  implementation  of 
a lunar  science  program  to  support  the  Apollo  Program. 


B.  The  Director  of  the  George  C,  Marshall  Space  Flight  Center  is 
responsible  for  the  design,  development,  fabrication,  quali- 
fication, acceptance  test  and  delivery  of  the  Saturn  launch 
vehicles  including  engines,  associated  ground  support  equip- 
ment and  assigned  experiments;-  providing  mission  planning  data 
from  the  standpoint  of  overall  vehicle  performance;  providing 
launch  vehicle  data  and  software  for  launch  vehicle  guidance 
and  checkout;  for  establishing  prelaunch  requirements  for  test, 
checkout  and  inspection  of  Saturn  launch  vehicles;  and  sup- 
porting launch  and  flight  operations  as  requested  by  KSC  and 
MSC . 
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C.  The  Director  of  the  John  F.  Kennedy  Space  Center  is  responsible  for 
development  and  operation  of  launch  and  industrial  facilities  and  associated 
ground  support  equipment  required  to  support  the  Apollo  Program  and  the 
assembly,  test,  inspection,  checkout  and  launch  of  Apol lo-Saturn  space 
vehicles  at  KSC. 

D.  Center  Directors  will  retain  ultimate  responsibility  for  Apollo  Program 
functions  delegated  within  the  Center,  and  will  supervise  their  performance. 
Significant  changes  in  delegation  of  functions  will  be  discussed  with  the 
Apollo  Program  Director  prior  to  implementation. 

IV.  FUNCTIONS 

A.  Manned  Spacecraft  Center 

The  Manned  Spacecraft  Center  is  assigned  the  following  functions  for 
the  Apollo  Program: 

1 . Hardware 


a.  Providing  for  the  detailed  specifications,  design,  manufacture, 
checkout,  test,  reliability  and  quality,  qualification,  and 
acceptance  of  MSC  developed  hardware.  This  does  not  include  the 
test  and  checkout  functions  accomplished  at  the  launch  site  by  KSC. 

b.  Developing  and  delivering  to  KSC  spacecraft  which  has  been  qualified 
for  flight  along  with  associated  software,  data  and  support  equipment. 

c.  Providing  for  the  detailed  specifications,  design,  development, 
fabrication,  qualification,  acceptance  test  and  delivery  of 
experiments  flight  hardware  and  associated  specialized  ground 
equipment  for  those  experiments  approved  by  the  Manned  Space 
Flight  Experiments  Board  and  assigned  by  the  Apollo  Program 
Director. 

d.  Providing  logistic  support  planning  and  implementation  at 
factory,  test  and  launch  sites  for  MSC  developed  hardware.. 

e.  Controlling  receipt  and  stowage  of  flight  crew  personal 
equipment  at  KSC  which  is  scheduled  for  flight  and  providing 
to  KSC  a list  of  equipment  which  is  considered  flight  crew 
personal  equipment. 

2 . Configuration  Control 

a.  Establishing  and  controlling  configuration  of  spacecraft 

hardware,  associated  software  and  support  equipment  (designed 
or  provided  by  MSC)  at  each  stage  of  preparation  or  test  in  the 
factory,  test  or  launch  site,  including  approval  of  changes  at 
KSC. 
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b.  Providing  and  maintaining  a list  of  acceptable  items  and  materials 
that  nay  enter  L lie  spacecraft  for  checkout  and  for  flight. 

3 . Test  and  Checkout 


a.  Establishing  and  maintaining  test  and  checkout  requirements  and 
test  and  checkout  specifications  and  criteria  for  factory  or  test 
site  acceptance  and  launch  site  preparation  of  MSC  developed  hardware 
(including  Ground  Support  Equipment  and  software). 

b.  Providing  test  and  checkout  requirements  and  test  and  checkout 
specifications  and  criteria  for  launch  site  preparation  of  MSC 
developed  hardware,  software  and  Ground  Support  Equipment. 

c.  Reviewing  factory,  test  site  and  launch  site  test  requirements 
and  test  and  checkout  plans  and  procedures  as  necessary  to 

assure  that  adequate  testing  is  being  accomplished  without  unnecessary 
overlap  and  duplication  between  testing  conducted  at  different  locations. 

d.  Providing  written  approval  of  KSC  test  and  checkout  plans  in 
consonance  with  paragraphs  IV. A, 3b  and  IV. A. 3c. 

e.  Providing  Center  approved  factory  or  test  site  test  and  checkout 
procedures  to  KSC  for  use  as  a baseline  in  the  development  of 
similar  procedures  required  at  the  launch  site. 

f.  Reviewing  at  the  option  of  MSC,  the  adequacy  of  KSC  test 
procedures  at  the  launch  site. 

g.  Providing  requirements  and  criteria  to  KSC  for  assuring  flight 
readiness  of  experiments  flight  hardware,  unless  KSC  and  MSC  on 
the  basis  of  written  agreement  for  a specific  experiment  make 
other  arrangements  for  flight  readiness  determination. 

h.  Determining  functional  performance  and  flight  readiness  of 
flight  hardware  closed  out  at  the  factory  or  test  site  and  not 
accessible  for  inspection  or  not  included  in  test  and  checkout 
requirements  for  evaluation  of  functional  performance  at  KSC. 

i.  Providing  such  technical  assistance  or  data  as  may  be  required 
by  KSC  in  preparation  of  hardware  for  flight. 

j.  Assuring  that  MSC  personnel  participating  in  KSC  tests  are 
responsive  to  KSC  direction  during  conduct  of  the  tests  and 
attend  pre-test  briefings  and  participate  in  training  exercises 
as  required  by  KSC  in  accordance  with  responsibilities  outlined 
herein . 

k.  Providing  an  assessment  of  flight  readiness  of  the  spacecraft  and 
associated  software  at  the  Flight  Readiness  Review  in  accordance 
with  Apollo  Program  Directives. 
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U . Reliability  and  Quality  Assurance 

a.  Providing  quality  control  requirements  and  inspection 
criteria  for  MSC  developed  hardware  for  use  at  the 
factory,  test  site  and  launch  site. 

b.  Conducting  audits  to  evaluate  contractor  factory  and 
test  site  performance  in  accordance  with  MSC  quality 
control  requirements  and  inspection  criteria  for  MSC 
developed  hardware,  and  participating  at  the  option  of 
MSC  in  audits  conducted  by  KSC  at  the  launch  site. 

c.  Determining  corrective  action  and  disposition  of  MSC 
developed  hardware  which  fails,  malfunctions  or  performs 
outside  the  performance  limits  contained  in  test  and 
checkout  specifications  and  criteria  during  checkout  at 
KSC.  This  responsibility  does  not  include  routine 
trouble-shooting  or  maintenance  of  MSC  developed  ground 
support  equipment  operated  by  KSC. 

5 . Systems  Engineering 

Providing  MSC  technical  representation  on  design  and  operations 

inter-Center  panels  or  working  groups  as  established  by  Apollo 

Program  Directives. 

6 . Operations 

a.  Developing  ^flight  techniques  for  mission  control  and 
hardware  and  software  for  the  Mission  Control  Center. 

b.  Developing  mission  objectives,  plans  and  rules  to  support 
Apollo  mission  assignments. 

c.  Conducting  flight  operations. 

d.  Obtaining  from  KSC  the  operational  requirements  pertain- 
ing to  checkout  and  launch  which  need  to  be  incorporated 
into  MSC  designed  hardware. 

e.  Planning  jointly  with  the  Department  of  Defense  the 
provision  of  recovery  support. 

f.  Providing  input  to  and  comment  on  KSC  launch  rules. 

g.  Identifying  MSC  operational  support  requirements  according 
to  approved  procedures  and  evaluating  support  implementation 
of  said  requirements. 


NASA  FORM  444  imv.  jul.mi  phivioui  editioni  ani  omolITI 


E-U7 


PiOE 


4 of  X6pA-ac» 


DATE 


OFFICE  OF  MANNED  SPACE  FLIGHT 

PROGRAM  DIRECTIVE 


M-D 


MA 


]i|Q0.09b ' 

(Protect-) 


5 AUG  1968 


7 . Flight  Crew 

a.  Providing  trained  flight  crews  and  personal  equipment  for  manned  missions, 

b.  Directing  all  astronaut  activities  except  during  the  time  they  are 
participating  in  KSC  flight  hardware  tests. 

c.  Developing  and  operating  flight  crew  simulators  and  training  equipment  at 
MSC  and  KSC. 

8 . Sc iencc 


a.  Planning  and  implementation  of  a lunar  science  program  to  support  Apollo, 

including  site  selection,  lunar  science  operations,  the  Lunar  Receiving 

Laboratory  operation  and  lunar  sample  analysis. 

9 .  Management 

This  section  contains  general  management  responsibilities  for  the  conduct  of 
the  Apollo  program  at  MSC  as  well  as  some  specific  management  requirements 
which  need  to  be  highlighted. 

General 

a.  Assuring  that  Apollo  program  requirements  for  manpower  or  for 
institutional  support  from  other  elements  of  MSC  are  properly  conveyed 
to  those  elements  and  that  Apollo  program  institutional  support 
requirements  are  reflected  in  Center  resource  requirements  plans, 
schedules,  and  budgets. 

b.  Assuring  that  Apollo  program  requirements  for  institutional  support 
are  met  on  an  effective  and  timely  basis. 

c.  Developing  and  operating  Center  facilities  required  for  the  Apollo 
Program. 

d.  Developing  and  implementing  adequate  security  procedures. 

e.  Establishing  detailed  schedules  (Levels  2,  3 and  4)  for  MSC  hardware, 
software  and  associated  equipment  and  operations  activities  consistent 
with  the  basic  schedules  (Level  1)  approved  by  the  Director,  Apollo 
Program,  and  the  Director,  Mission  Operations. 

f.  Providing  contract  authority  for  KSC  control  of  spacecraft  contractor  s 
test  and  checkout  activities  at  KSC  through  a supplemental  contract 
under  KSC  administration. 

Medica  1 

Medical  support  for  the  Apollo  program  will  be  provided  in  accordance  with 

NMI  8900.1.  In  addition,  the  following  specific  requirements  will  be  met 

on  the  Apollo  program. 
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a*  Providing  for  the  medical  surveillance  and  support  of  the  astronauts 
during  all  phases  of  the  Apollo  Program  at  any  location  including 
test  and  checkout  operations. 

b.  Providing  for  the  evaluation  of  medical  data  obtained  during  manned 
tests,  to  insure  that  the  interpretation  of  such  data  regarding 
the  acceptability  of  equipment  performance  is  properly  reflected 
in  post  flight  mission  reports. 

c Providing  for  the  development  and  implementation  of  medical  disaster 
plans  associated  with  the  test  of  Apollo  hardware  at  MSC. 

Safety 

Safety  activities  in  the  Apollo  program  will  be  conducted  in  accordance 
with  instructions  provided  by  the  Apollo  Program  Director  and  directives 
issued  by  the  Manned  Space  Flight  and  NASA  Safety  Directors.  In  addition 
the  following  specific  requirements  will  be  met  on  the  Apollo  program. 

a.  Providing  written  approval  of  KSC  criteria  for  determining  hazardous 
operations  at  the  launch  site. 

b.  Reviewing  and  approving  any  KSC  test  and  checkout  procedure  in  which 
the  flight  crew  participates. 
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B . George  C.  Marshall  Space  Flight.  Center 

The  George  C.  Marshall  Space  Flight  Center  is  assigned  the  following  functions  for 
the  Apollo  Program. 

1 .  Hardware 


a.  Providing  for  the  detailed  specifications,  design,  manufacture,  checkout, 
test,  reliability  and  quality,  qualification  and  acceptance  of  MSFC 
developed  hardware.  This  does  not  include  the  test  and  checkout  functions 
accomplished  at  the  launch  site  by  KSC. 

b.  Developing  and  delivering  to  KSC  launch  vehicles  which  have  been  qualified 
for  flight  along  with  associated  software,  data  and  support  equipment, 

c.  Providing  for  the  detailed  specifications,  design,  development,  fabrication, 
qualification,  acceptance  test  and  delivery  of  experiments  flight  hardware 
and  associated  specialized  ground  equipment  for  those  experiments  approved 
by  the  Manned  Space  Flight  Experiments  Board  and  assigned  by  the  Apollo 
Program  Director. 

d.  Providing  logistic  support  planning  and  implementation  at  factory,  test  and 
launch  sites  for  MSFC  controlled  hardware. 


2 . Configuration  Control 

a.  Establishing  and  controlling  configuration  of  launch  vehicle  hardware,  asso- 
ciated software  and  support  equipment  (designed  or  provided  by  MSFC)  at  each 
stage  of  preparation  or  test  in  the  factory,  test  or  launch  site,  including 
approval  of  changes-at  KSC. 

b.  Providing  criteria  to  KSC  for  controlling  tools,  equipment  and  materials  that 
enter  and  leave  the  launch  vehicle  stages  and  instrument  unit  during 
operations  at  KSC. 

3.  Test  and  Checkout 

a.  Establishing  and  maintaining  test  and  checkout  requirements  and  test  and 
checkout  specifications  and  criteria  for  factory  or  test  site  acceptance  and 
launch  site  preparation  of  MSFC  developed  hardware  (including  Ground  Support 
Equipment  and  software). 

b.  Providing  test  and  checkout  requirements  and  test  and  checkout  specifications 
and  criteria  for  launch  site  preparation  of  MSFC  developed  hardware,  software 
and  Ground  Support  Equipment. 

c.  Reviewing  factory,  test  site  and  launch  site  test  requirements  and  test  and 
checkout  plans  and  procedures  as  necessary  to  assure  that  adequate  testing 
is  being  accomplished. 

d.  Providing  written  approval  of  KSC  test 'and  checkout  plans  in  consonance  with 
paragraphs  IV.B.3b  and  IV,B,3c. 

e.  Providing  Center  approved  factory  or  test  site  test  and  checkout  procedures 
to  KSC  for  use  as  a baseline  in  the  development  of  similar  procedures 
required  at  the  launch  site. 
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f,  Reviev7ing  at  the  option  of  MSFC,  the  adequacy  of  KSC  test  procedures 
at  the  launch  site. 


g.  Providing  requirements  and  criteria  to  KSC  for  assuring  flight 
readiness  of  experiments  flight  hardware,  unless  KSC  and  MSFC  on 
the  basis  of  written  agreement  for  a specific  experiment  make  other 
arrangements  for  flight  readiness  determination. 

h.  Determining  functional  performance  and  flight  readiness  of  flight 
hardware  closed  out  at  the  factory  or  test  site  and  not  accessible 
for  inspection  or  not  included  in  test  and  checkout  requirements 
for  evaluation  of  functional  performance  at  KSC. 

i.  Providing  such  technical  assistance  or  data  as  may  be  required  by 
KSC  in  preparation  of  hardware  for  flight. 

j.  Assuring  that  MSFC  personnel  participating  in  KSC  tests  are  responsive 
to  KSC  direction  during  conduct  of  the  tests  and  attend  pre-test 
briefings  and  participate  in  training  exercises  as  required  by  KSC 

in  accordance  with  responsibilities  outlined  herein. 

k.  Providing  an  assessment  of  flight  readiness  of  the  launch  vehicle  and 
associated  software  at  the  Flight  Readiness  Review  in  accordance  with 
Apollo  Program  Directives. 


A.  Reliability  and  Quality  Assurance 

a.  Providing  quality  control  requirements  and  inspection  criteria  for  MSFC 
developed  hardware  for  use  at  the  factory,  test  site  and  launch  site. 

b.  Conducting  audits  to  evaluate  contractor  factory  and  test  site  performance 
in  accordance  with  MSFC  quality  control  requirements  and  inspection 
criteria  for  MSFC  developed  hardware,  and  participating  at  the  option 

of  MSFC  in  audits  conducted  by  KSC  at  the  launch  site. 

c.  Determining  corrective  action  and  disposition  of  MSFC  developed  hardware 
which  fails,  malfunctions,  or  performs  outside  the  performance  limits 
contained  in  test  and  checkout  specifications  and  criteria  during 
checkout  at  KSC.  This  responsibility  does  not  include  routine  trouble- 
shooting or  maintenance  of  MSFC-developed  ground  support  equipment 
operated  by  KSC. 


5 . Systems  Engineering 

a.  Providing  MSFC  technical  representation  on  design  and  operations  inter 
Center  panels  or  working  groups  as  established  by  Apollo  Program 
Directives . 


b.  Providing  the  overall  integrated  space  vehicle  systems  analysis  and 
criteria  for  operational  requirements  and  limitations  for  handling, 
checkout,  launch  and  flight  as  required  by  MSFC,  MSC  and  KSC. 


c.  Operating  the  Manned  Space  Flight  Interface  Documentation  Repository. 
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6 . Operations 


a.  Developing  mission  objectives  and  plans  to  support  Apollo  mission 
ass ignments , 

b.  Providing  real  time  mission  support  as  requested  by  MSC  and  KSC  both  on 
site  and  at  Huntsville. 

c.  Providing  input  to  and  comment  on  KSC  launch  and  MSC  flight  mission  rules. 

d.  Obtaining  from  KSC  the  operational  requirements  pertaining  to  checkout  and 
launch  which  need  to  be  incorporated  into  MSFC  designed  hardware. 

e.  Identifying  MSFC  operational  support  requirements  according  to  approved 
procedures  and  evaluating  support  implementation  of  said  requirements. 

7 . Flight  Crew 

Providing  instructions  and  material  for  training  and  familiarization  of  flight 

crews  with  the  Saturn  vehicle. 

8.  Science 


None 

9*  Management 

This  section  contains  general  management  responsibilities  for  the  conduct  of 
the  Apollo  program  at  MSFC  as  well  as  some  specific  management  requirements 
which  need  to  be  highlighted. 

General 

a.  Assuring  that  Apollo  program  requirements  for  manpower  or  for  insti- 
tutional support  from  other  elements  of  MSFC are  properly  conveyed  to 
those  elements  and  that  Apollo  program  institutional  support  requirements 
are  reflected  in  Center  resource  requirements  plans,  schedules,  and 
budgets . 

b.  Assuring  that  Apollo  program  requirements  for  institutional  support 
are  met  on  an  effective  and  timely  basis. 

c.  Developing  and  operating  Center  facilities  required  for  the  Apollo 
Program. 

d.  Developing  and  implementing  adequate  security  procedures. 

e.  Establishing  detailed  schedules  (Levels  2,  3 and  4)  for  MSFC  hardware, 
software,  and  associated  equipment  consistent  with  the  basic  schedules 
(Level  1)  approved  by  the  Apollo  Program  Director. 

f.  Providing  liquid  hydrogen  management  for  MSFC  and  KSC. 
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g.  Providing  contract  authority  for  KSC  control  of  launch  vehicle 

contractor's  test  and  checkout  activities  at  KSC  through  a supplemental 
contract  under  KSC  administration. 

Medical 


Medical  support  for  the  Apollo  program  will  be  provided  in  accordance 
with  NMI  8900.1.  In  addition,  the  following  specific  requirement  will 
be  met  on  the  Apollo  program. 

3(  Providing  for  the  development  and  implementation  of  medical  disaster 
plans  associated  with  the  test  of  Saturn  hardware  at  1EFC. 

Safety 

Safety  activities  in  the  Apollo  program  will  be  conducted  in  accordance 
with  instruction  provided  by  the  Apollo  Program  Director  and  directives 
issued  by  the  Manned  Space  Flight  and  NASA  Safety  Directors.  In  addition 
the  following  specific  requirement  will  be  met  on  the  Apollo  program. 

a.  Providing  written  approval  on  KSC  criteria  for  determining  hazardous 
operations  at  the  launch  site. 
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C • John  F.  Kennedy  Space  Center 

The  John  F.  Kennedy  Space  Center  is  assigned  the  following  functions  for  the 
Apollo  Program, 

1.  Hardware 


a.  Providing  for  detailed  specifications,  design,  manufacture,  checkout, 
test,  reliability  and  quality,  qualification  and  acceptance  of  KSC 
developed  hardware, 

b.  Developing  and  delivering  qualified  ground  support  equipment  associated 
with  launch  facilities  and  not  provided  by  MSC  or  MSFC, 

c.  Developing  and  operating  ground  communications , computation,  and  instru- 
mentation systems  and  equipment  for  the  conduct  of  launch  operations, 

d.  Taking  measures  to  protect  flight  hardware  and  associated  Ground 
Support  Equipment  from  contamination,  corrosion  or  damage  which  may 
result  from  environment,  housekeeping,  procedure  or  human  error  and 
reporting  incidents  to  MSC  and  MSFC  as  appropriate. 

e.  Providing  logistics  support  planning  and  implementation  at  the  factory 
test  or  at  KSC  for  KSC  developed  hardware, 

2,  Configuration  Control 

a.  Establishing  and  controlling  configuration  of  KSC  developed  launch 
facilities  and  ground  support  equipment  at  each  stage  of  preparation 
or  test  at  the  factory,  test  site  or  at  KSC. 

b.  Maintaining  configuration  control  of  MSC  and  MSFC  developed  hardware  and 
software  after  delivery  to  KSC  in  accordance  with  the  configuration 
requirements  established  by  MSC  and  MSFC,  Assuring  that  prior  approval 
is  secured  from  MSC  and  MSFC  before  any  changes  in  configuration  are 
made  in  spacecraft,  launch  vehicle,  or  associated  GSE  furnished  by  MSC 
or  MSFC. 

c.  Securing,  after  the  flight  readiness  test,  the  prior  approval  of  MSC 
or  MSFC  for  the  replacement  of  failed  parts. 

d.  Controlling  everything  that  enters  and  leaves  the  spacecraft  during 
checkout  at  KSC  in  accordance  with  the  MSC  list  of  acceptable  items 
and  materials  that  may  be  taken  into  the  spacecraft  for  checkout  and 
for  flight. 

e.  Controlling  tools,  equipment  and  materials  that  enter  and  leave  the  launch 
vehicle  stages  and  instrument  unit  during  operations  at  KSC  in  accordance 
with  criteria  provided  by  MSFC, 
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3 Logistics  Management 

a.  Provide  total  logistics  support  planning  and  management  for  all 
KSC  equipment.  Plan  for  the  utilization  at  KSC  of  equipment  pro- 
vided by  other  design  cognizant  centers,  using  the  inter-center 
coordinated  support  planning  provided  by  those  centers. 

b.  Provide  logistics  products  and  services  to  meet  the  valid  intent 
of  KHB  7500.1  for  KSC  designed  equipment.  Utilize  logistics 
products  and  services  provided  by  other  centers  to  support  equip- 
ment under  their  design  cognizance,  unless  stipulated  otherwise 
in  inter-center  logistics  agreements. 

c Receive,  store,  issue  and  dispose  of  spare  parts  for  all  Apollo 
Program  equipment  operated  at  KSC  in  accordance  with  inter-center 
coordinated  plans  and  directions  from  the  design  cognizant  centers. 

d.  Provide  reports  of  logistics  requirements,  status  and  spares  con- 
sumption as  required. 

e.  Establish,  implement  and  control  a logistics  discrepancy  reporting 
system. 

4.  Test  and  Checkout 

a.  Conducting  the  assembly,  checkout,  ar.d  launch  of  flight  hardware 
for  Apollo  missions  and  assembly,  checkout  and  operation  of  re- 
quired ground  support  equipment. 

b.  Providing  control  of  all  personnel  participating  in  test  and 
checkout  activities,  including  representatives  from  MSC  and  MpFC, 
and  assuring  that  personnel  attend  pre-test  briefings  and  parti- 
cipate in  training  exercises  as  necessary  to  assure  personnel 
safety  and  proper  conduct  of  the  tests. 

c Providing  recuirement:. . specifications  and  criteria,  and  pro- 
* cedures  for  test  and  lockout  of  KSC  developed  support  equipment 
whose  performance  must  be  verified  for  each  launch. 

d.  Providing  test  and  checkout  plans  In  accordance  with  MSC  and  MSFC 
test  and ^checkout  requirements  plus  any  additional  KSC  test  re- 
quirements recessar^  to  verify  launch  facility.  Manned  Space  Plight 
Network  and  launch  crew  readiness  or  to  satisfy  range  and  safety 
requirements . 

e.  Securing  MSC  and  MSEC  written  approval  or.  test  and  checkout  Plans 
and  changes  thereto  before  the  plans  are  approved  or  implemented. 

f.  Developing  and  providing  to  MSC  or  MSFC  test  and  checkout  pro- 
cedures adapted  to  the  KSC  environment  using  as  a baseline  the 
development  center  approved  factory  test  and  checkout  procedures. 
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g.  Making  final  determination  that  test  and  checkout  procedures 
are  adequate,  safe  and  in  accordance  with  MSC  and  MSFC  test 
and  checkout  requirements  and  test  and  checkout  specifications 
and  criteria, 

h.  Obtaining  approval  on  deviations  and  waivers  from  MSC  and  MSFC 
concerning  test  and  checkout  requirements,  test  and  checkout 
specifications  and  criteria  and  inspection  criteria  when  unable 
to  meet  requirements. 

1,  Determining  functional  performance  and  flight  readiness  of  flight 
hardv.'are  and  software  in  accordance  with  test  and  checkout  re- 
quirements and  test  and  checkout  specifications  and  criteria 
provided  by  MSC  and  MSFC  except  for  that  which  is  closed  out  at 
the  factory  and  not  accessible  for  inspection  or  not  included 
in  test  and  checkout  requirements  for  evaluation  of  functional 
performance  at  KSC. 

j.  Determining  flight  readiness  of  equipment  associated  with  inflight 
experiments  in  accordance  with  MSC  or  MSFC  (a3  appropriate)  speci- 
fications and  criteria  unless  specifically  excluded  by  written 
agreement  with  MSC  or  MSFC. 

k.  Controlling  receipt  and  storage,  and  assuring  flight  readiness  of 
all  Government  Furnished  Equipment,  other  than  flight  crew  personal 
equipment,  which  is  scheduled  for  flight  and  which  is  not  processed 
to  KSC  through  a contractor  responsible  to  KSC. 

l.  Providing  routine  trouble  shooting  and  maintenance  for  MSC  and 
MSFC  developed  equipment  in  accordance  with  MSC  and  MSFC  require- 
ments, specifications  and  criteria. 

m.  Providing  an  assessment  of  the  flight  readiness  of  the  launch 
complex,  flight  hardware  and  software  at  the  Flight  Readiness 
Review  in  accordance  with  Apollo  Program  Directives. 

Reliability  and  Quality  Assurance 

a.  Providing  quality  control  requirements  and  inspection  criteria 
for  KSC  developed  hardware  for  use  at  the  factory,  test  site  and 
KSC. 

b.  Conducting  audits  to  evaluate  contractor  factory  and  test  site 
performance  in  accordance  with  KSC  quality  control  requirements 
and  Inspection  criteria  for  KSC  developed  hardware. 

c.  Determining  corrective  actidn  and  disposition  of  KSC  developed 
hardware  which  falls,  malfunctions,  or  performs  outside  the  per- 
formance limits  contained  in  test  and  checkout  specifications  and 
criteria  during  checkout  at  KSC. 
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d.  Generating  approval  from  the  appropriate  development  center  (MSC 
or  MS  PC ) to  disassemble  or  open  any  flight  hardware  closed  out 
at  a factory  or  test  site. 

e.  Securing  MSC  and  MSFC  written  approval  of  quality  control  plans 
insofar  as  development  center  responsibilities  are  concerned 
before  the  plans  are  approved  or  implemented. 

f.  Conducting  quality  control  inspections  and  audits  of  contractor 
activities  at  KSC  and  inviting  MSC  and  MSFC  participation  as 
applicable . 

g.  Obtaining  approval  from  the  appropriate  development  center  (MSC 
or  MSFC)  to  disassemble  or  open  any  flight  hardware  closed  out  at 
a factory  or  test  site. 

h.  Advising  MSC  or  MSFC  of  any  problem  arising  during  prelaunch 
preparation  concerning  flight  worthiness  of  flight  hardware. 

i.  Conducting  failure  analysis  as  required  by  MSC  and  MSFC. 

j.  Participating  in  MSC  and  MSFC  flight  hardware  acceptance  reviews 
and  providing  recommendations  to  MSC  or  MSFC  and  the  Apollo 
Program  Director,  concerning  the  acceptance  of  the  hardware  for 
shipment  to  KSC. 

6.  Systems  Engineering 

Providing  KSC  representation  on  design  and  operations  inter-Center 
panels  or  working  groups  as  established  by  Apollo  Program  Directives. 

7 . Operations 

a.  ‘Identifying  KSC  operational  support  requirements  according  to 
approved  procedures  and  evaluating  implementation  of  support 
planning . 

b.  Providing  data  to  MSC  and  MSFC  in  accordance  with  approved  Program 
Support  Requirements  Documents. 

c.  Conducting  launch  operations. 

d.  Developing  launch  plans  and  rules. 

8 . Flight  Crew 

Coordinating  and  directing  astronaut  activities  during  the  time  they 
are  actively  participating  in  KSC  tests  of  flight  hardware  except  that 
the  flight  crew  may  take  any  action  necessary  for  their  safety. 

Science 
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10 . Management 

This  section  contains  general  management  responsibilities  for  the 
conduct  of  the  Apollo  program  at  KSC  as  well  as  some  specific  .manage 
ment  requirements  which  need  to  be  highlighted. 

General 

a.  Assuring  that  /.  rw.jlo  program  requirements  for  manpower  or 
for  institutional  support  from  other  elements  of  KSC  are 
properly  convoyed  to  those  elements  and  that  Apollo  program 
institutional  support  requirements  are  reflected  in  Center 
resource  requirements  plans,  schedules,  and  budgets. 

b.  Assuring  that  Arollo  program  requirements  for  institutional 
support  are  met  on  an  effective  and  timely  basis. 

c.  Providing  control  of  all  activities  of  Apollo  contractors 
at  KSC  other  tu^n  those  directly  associated  with  astronaut 
training. 

d.  Developing  arid  operating  Center  facilities  required  for 
the  Apollo  Program, 

e.  Developing  and  jmplementing  adequate  security  procedures. 

f.  Establishing  detailed  schedules  (Levels  2,  3 and  4)  for 
KSC  hardware,  software  and  associated  equipment  consistent 
with  the  basic  schedules  (Level  l)  approved  by  the  Director, 
Apollo  PrograrrTand  the  Director,  Mission  Operations. 

Medical 


Medical  support  for  the  Apollo  program  will  be  provided  in 
accordance  with  NMI  89OO.I.  In  addition,  the  following  specific 
requirement  will  be  met  on  the  Apollo  program. 

a.  Providing  for  the  development  and  implementation  of  medical 
disaster  plans  associated  with  the  assembly,  checkout  and 
prelaunch  operations  of  Apollo  flight  hardware  at  KSC. 

Safety 

Safety  activities  in  the  Apollo  program  will  be  conducted  in 
accordance  with  instructions  provided  by  the  Apollo  Program 
Director  and  directives  issued  by  the  Manned  Space  Flight  and 
NASA  Safety  Directors,  In  addition  the  following  specific 
requirements  will  be  met  on  the  Apollo  program. 


E-58 


NASA  FORM  A44  « 


PAGI 


15  16 


OFFICE  OF  MANNED  SPACE  FLIGHT 

PROGRAM  DIRECTIVE 


5 AUG  1968 


a.  Performing  as  the  NASA  single  point  of  responsibility 
for  safety  in  the  Merritt  Island  and  Cape  Kennedy  area 
and  for  NASA  range  safety  inputs  to  the  Eastern  Test 
Range . 

b.  Developing  criteria  for  determining  hazardous  operations 
at  the  launch  site  and  securing  written  approval  of  MSC 
and  MSFC . 

V.  PRECEDENCE 

This  Directive  takes  precedence  over  any  inter-Center  agreements  on 
Apollo  program  responsibilities. 

VI.  CONCURRENCE 


This  Program  Directive  has  been  reviewed  and  concurred  in  by  the 
Associate  Administrator  for  Manned  Space  Plight  and  the  Associate 
Administrator  for  Organization  and  Management.  Any  proposed  sub- 
stantive changes  in  the  responsibilities  defined  in  this  document 
will  be  submitted  for  review  and  concurrence  in  the  same  manner. 
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PROGRAM  MANAGEMENT  CONTINUITY 


The  Panel  considered  the  question  of  continuity  of  experience  in 
certain  key  positions  at  MSC,  KSC,  NR-Downey,  and  Beech,  and  found 
that  it  has  been  good. 

At  MSC,  three  different  men  have  held  the  Subsystem  Manager  posi- 
tion for  the  cryogenic  gas  storage  subsystem  since  November  1963.  The 
first  held  the  position  for  nearly  3 years  during  the  later  design 
phases  and  through  most  of  the  oxygen  tank  development  period.  The 
second  Subsystem  Manager  was  in  the  position  from  1966  through  1968  and 
was  then  succeeded  by  the  present  incumbent,  who  had  been  his  assistant. 

In  the  MSC  ASPO,  there  have  been  five  Program  Managers,  two  during 
the  design  and  development  of  the  oxygen  tank.  Additional  continuity 
in  this  position  was  provided  from  1961  through  1966,  by  the  fact  that 
the  first  Program  Manager  became  the  Deputy  Program  Manager  in  1962  and 
served  in  that  position,  under  two  successive  Program  Managers,  through 
1965.  In  1967,  when  the  Program  Manager  next  changed,  the  position  was 
taken  by  the  then  Deputy  Director  of  the  Center,  who  had  been  associ- 
ated with  the  Program  from  that  position.  The  present  Program  Manager, 
who  took  over  last  year,  had  been  an  astronaut  with  detailed  famili- 
arity with  the  manned  space  flight  program  since  1962. 

At  KSC,  the  persons  with  principal  responsibility  for  the  test, 
checkout , and  launch  of  all  Apollo  spacecraft  are  the  Director  of  Launch 
Operations  and,  reporting  to  him,  the  Director  of  Spacecraft  Operations. 
Continuity  in  these  positions  has  been  good.  The  present  Director  of 
Launch  Operations  was  the  Deputy  Director  for  the  prior  2 years,  approxi- 
mately. Before  that  he  had  been  the  head  of  the  MSC  Resident  Apollo 
Spacecraft  Office  at  KSC.  The  present  incumbent  of  the  Spacecraft 
Operations  position  has  occupied  that  position  for  5 years.  Prior  to 
that  time  he  served  as  the  Assistant  Manager  for  Gemini,  MSC  Florida 
Operations . 

At  North  American  Rockwell  the  position  with  direct  responsibility 
for  overseeing  design  and  manufacture  of  the  cryogenic  gas  storage 
system  (CGSS)  by  the  subcontractor,  Beech,  is  the  Manager,  Fuel  Cells 
and  Cryogenic  Systems  (fig.  EU-10).  The  present  incumbent  of  that 
position  has  held  it  since  1962  and  has  been  NR-Subsystem  Manager  for 
the  Apollo  CGSS  over  that  entire  period.  The  present  Apollo  Program 
Manager  at  NR  succeeded  to  that  position  last  year  when  the  former 
Program  Manager  was  appointed  NASA  Associate  Administrator  for  Manned 
Space  Flight.  Prior  to  his  promotion,  the  present  Program  Manager  had 
been  the  Assistant  CSM  Program  Manager  for  about  U years. 
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At  Beech-Boulder  Division,  the  same  men  have  occupied  one  or 
another  of  the  key  positions  in  the  CGSS  contract  to  NR  over  the  life 
of  the  contract.  There  has  been  turnover  in  manufacturing  personnel 
at  the  technician  and  trades  levels  but  the  principal  managers  and 
supervisors  have  not  changed.  It  is  noteworthy  that  when  members  of 
the  Apollo  13  Review  Board  visited  Beech  for  a demonstration  of  the 
assembly  of  an  Apollo  oxygen  tank,  the  technician  who  performed  the 
assembly  demonstration  was  the  same  man  who  had  assembled  Apollo  13 
tank  no.  2 in  1966. 
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APOLLO  SPACECRAFT  PROGRAM  MANAGEMENT  SYSTEMS 


The  various  organizational  relationships  and  the  management  philos- 
ophy for  Apollo  are  defined  in  reference  1.  This  document  defines  the 
relationship  and  functioning  of  the  various  organizational  elements 
which  have  been  described  in  Parts  E4  and  E5  of  this  Appendix.  In 
addition,  there  are  several  other  documents  which  provide  implementing 
details  concerning  the  management  control  systems  and  their  intended 
operation. 

A general  understanding  of  the  management  systems  which  are  being 
used  and  their  relationship  to  the  program  progress  is  helpful  in  deter- 
mining or  appreciating  the  extent  of  the  review  which  is  applied  to  all 
phases  of  the  program  throughout  design,  manufacturing,  test,  checkout, 
and  operation. 

It  is  also  considered  important  to  recognize  that  some  of  the  re- 
view and  control  systems  are  primarily  concerned  with  the  entire  scope 
of  a module  program  and  that  others  concentrate  on  individual  modules 
by  serial  number. 

The  systems  which  have  been  implemented  by  MSC  are  generally  simi- 
lar for  both  the  CSM  and  the  LM.  Due  to  the  nature  of  this  review,  the 
CSM  only  is  considered  and  all  subsequent  reference  to  a vehicle  means 
the  CSM  or  more  particularly  the  service  module. 

There  are  three  management  systems  which  directly  impact  all  CSMfs 
at  various  points  in  time: 

(a)  Design  Reviews 

(b)  Configuration  Management 

(c)  Readiness  Reviews 

Throughout  the  entire  management  process  the  Reliability  and  Qual- 
ity Assurance  system  maintains  a continuing  surveillance  of  all  problems. 


DESIGN  REVIEWS 

The  contractor  initiates  the  design  phase  of  the  contract  based  upon 
the  general  specifications  and  the  performance  requirements  established 
by  the  ASPO.  These  requirements  and  broad  specifications  are  developed 
by  the  MSC  technical  organization  and  approved  by  the  ASPO  prior  to  the 
contractor  initiating  activity. 
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Preliminary  Design  Review 

The  general  requirement  is  for  a Preliminary  Design  Review  (FDR) 
to  be  conducted  on  the  CSM  when  the  design  concept  has  been  determined 
by  the  contractor  and  prior  to  the  start  of  detail  design.  The  ASPO 
Systems  Engineering  Division  normally  organizes  and  conducts  these  reviews 
which  are  chaired  by  the  Apollo  Spacecraft  Program  Manager.  Various 
subsystems  may  reach  a design  concept  stage  earlier  than  others  and  a 
series  of  PDRTs  may  be  conducted.  The  result  of  the  PDR  is  to  establish 
the  design  requirements  baseline  from  which  engineering  control  can  be 
exercised.  Upon  the  completion  of  the  review,  the  ASPO  manager  author- 
izes Part  I of  the  end-item  specification  to  be  inserted  in  the  contract, 
along  with  any  necessary  design  modifications. 


Critical  Design  Review 

The  Critical  Design  Review  (CDR),  also  organized  and  conducted  by 
ASPO  Systems  Engineering  Division  and  chaired  by  the  ASPO  Manager,  is 
held  when  the  contractor  has  released  or  completed  between  90  and  95 
percent  of  the  engineering.  At  this  point  there  is  sufficient  informa- 
tion for  the  ASPO  and  the  appropriate  subsystem  managers  to  adequately 
review  the  engineering  and  to  determine  if  the  objectives  of  the  design 
concept  have  been  achieved.  Again,  because  the  engineering  for  different 
subsystems  is  not  all  completed  at  the  same  time,  a series  of  CDRTs  may 
be  conducted.  At  the  completion  of  the  CDR  a drawing  baseline  is 
established  and  the  strict  Configuration  Control  System  is  implemented. 


CONFIGURATION  MANAGEMENT 


A primary  document,  in  addition  to  reference  1 which  defines  the 
Configuration  Management  Control  System,  is  the  "Apollo  Spacecraft 
Program  Configuration  Management  Manual,"  (ref.  2).  This  document  de- 
tails the  various  change  control  levels,  defines  the  categories  of 
change,  and  establishes  the  membership  of  the  various  boards  and 
panels  which  are  involved.  Figure  E6-1  depicts  this  total  relationship 
among  the  five  change  control  levels.  This  document  contains  the  de- 
tailed instructions  which  are  necessary  to  implement  the  intent  of  the 
"Apollo  Configuration  Management  Manual"  as  modified  by  the  MSC  Supple- 
ment No.  1 (ref.  3) • 

As  shown  by  figure  E6-1,  there  are  actually  five  functioning  levels 
of  change  control  for  the  CSM.  The  Configuration  Control  Board  (CCB) , 
Level  II,  is  responsible  for  the  CSM,  LM,  and  affected  subsystems. 

The  Chairman  of  the  CCB  is  the  Apollo  Spacecraft  Program  Manager; 
and  the  ASPO  Managers  for  CSM,  LM,  the  Experiments  and  GFE,  the  Assis- 
tant Program  Manager  for  Flight  Safety,  and  the  MSC  Directors  of  the 
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Figure  E6-1.-  Configuration  Control  Boards  - Apollo  Spacecraft  Program. 


five  technical  Directorates  are  principal  members.  The  CCB  is  respon- 
sible for  approval  or  disapproval  of  changes  in  the  following  major 
categories : ° 

(a)  Changes  which  affect  an  interface  among  two  or  more  Configu- 
ration Control  Panels  (CCP) . ° 

(b)  Changes  which  affect  spacecraft  mass  properties. 

(c)  Change  resulting  in  contract  cost  increases  in  excess  of 

$300,000. 

(d)  Changes  which  affect  end-item  delivery  dates. 

It  should  be  noted  that  change  control  is  established  for  more  than 
merely  hardware  or  specification  baselines.  Also  included  are  software 
items,  such  as  mission  timeline,  math  models,  consumables,  and  schedules. 

Configuration  Control  Panels  (CCP)  are  established  at  Level  III  by 
the  authority  of  the  CCB  Chairman  and  are  designated  as  the  approving 
authority  for  all  Class  I changes  not  designated  for  CCB  action.  Class 
I changes  are  defined  in  general  as  those  affecting  the  specification, 
performance,  cost,  quality,  safety,  or  interchangeability.  Configura- 
tion Control  Panels  are  established  for  the  CSM,  LM,  and  GFE.  The  CSM 
CCP  is  chaired  by  the  ASPO  Manager  for  CSM.  Panel  membership  is  obtained 
primarily  from  the  same  organizations  as  indicated  for  the  CCB;  however, 
the  members  are  Division  Chief  level  or  designees  rather  than  Directors. 

The  Level  IV  CCP  is  at  the  Resident  Apollo  Spacecraft  Program  Office 
(RASPO)  at  Downey.  This  panel  is  chaired  by  the  Resident  Manager. 
Generally,  the  panel  can  approve  changes  which  concern  test  procedures 
but  not  hardware  configuration.  An  exception  to  this  is  made  during 
final  checkout  of  a specific  vehicle  or  during  field  test  or  launch 
preparation.  These  are  classed  as  compatibility  or  make-operable  changes, 
are  restricted  to  single  modules  only,  and  must  be  reported  to  the  CSM 
CCP  within  24  hours. 

A fifth  level  of  change  control  exists  because  all  changes  whether 
Class  I or  Class  II  must  go  through  the  Worth  American  Rockwell  (NR)  CCB. 
This  board  is  chaired  by  the  NR  Program  Manager.  It  approves  all  Class  I 
changes  for  submission  to  the  appropriate  NASA  authority  as  previously 
defined  and  has  the  authority  to  approve  Class  II  changes  for  implementa- 
tion. The  definition  of  Class  I and  Class  II  changes  is  that  contained  in 
ANA  Bulletin  445  (ref.  4)  which  is  considered  to  be  a standard  reference. 
Some  subsequent  modification  of  ANA  445  occurred  during  the  course  of  the 
NR  contract.  However,  the  effect  of  these  modifications  or  clarifications 
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was  to  make  the  procedures  and  definitions  more  restrictive.  It  is 
noted  that  all  Class  II  changes  which  are  approved  by  the  contractor 
are  submitted  to  the  RASPO  for  information.  This  provides  an  opportunity 
for  review.  Also,  the  NR  control  system  is  such  that  each  Class  II  item 
is  picked  up  and  reported  to  R&QA.  Class  II  changes  include  those  not 
defined  as  Class  I . 

Although  the  CCB  may  be  concerned  with  a change  to  a specific 
vehicle,  in  most  instances  the  changes  involve  all  of  the  remaining  vehi- 
cles to  be  manufactured  or  which  have  not  flown.  That  is,  a major  part 
of  the  effort  of  the  CCB  is  devoted  to  assuring  that  the  overall  config- 
uration is  appropriate  and  that  the  procedures  are  compatible  with  all 
elements  of  the  system.  In  general,  the  CCB  is  concerned  about  the 
configuration  of  the  basic  CSM.  Readiness  Reviews,  which  are  discussed 
in  the  following  section,  are  concerned  with  the  exact  configuration  of 
a specific  CSM. 

With  regard  to  subcontracts  like  that  for  the  oxygen  tanks,  there 
is  actually  an  additional  level  of  configuration  control  by  the  Beech 
Aircraft  Corporation.  Their  Configuration  Control  Board  reviews  all 
changes,  both  Class  I and  Class  II.  Class  I changes  are  sent  to  NR  for 
processing  through  the  system  and  Class  II  changes  may  be  approved  by 
Beech  for  implementation.  In  actual  practice  there  are  only  a few  Class 
II  changes  and  all  of  these  are  sent  to  NR  for  information  and  recorded 
in  the  system. 


READINESS  REVIEWS 


The  Readiness  Reviews  are  conducted  for  each  specific  vehicle. 
These  reviews  are  concerned  with  the  manufactured  subsystems  that  have 
been  assigned  to  a specific  CSM. 


Customer  Acceptance  Readiness  Reviews 

The  basic  objective  of  the  Customer  Acceptance  Readiness  Review 
(CARR)  is  to  evaluate  the  readiness  of  the  CSM  for  delivery  to  KSC  for 
launch  preparation.  The  CARR  Plan  for  Apollo  command  and  service  mod- 
ules was  revised  in  January  1969.  This  plan  is  referenced  in  the  Apollo 
Spacecraft  Program  Configuration  Management  Manual  (ref.  2)  and  has  gen- 
erally been  applicable  throughout  the  Apollo  Program.  The  plan  defines 
the  detailed  requirements  for  preparation  of  documentation,  subsystem 
reviews,  items  for  review  and  general  procedures.  Definition  of  the 
review  teams,  their  composition,  function,  and  tasks  are  also  contained 
in  the  CARR  Pla’v 


A complete  CARR  for  a specific  CSM  is  conducted  in  three  phases: 

(a)  Phase  I - To  be  conducted  by  the  ASPO  immediately  prior  to 
the  initiation  of  installed  subsystem  checkout  of  the  assembled  CSM  to 
identify  constraints  of  subsystem  tests.  This  includes  firm  identifica- 
tion of  constraints  to  system  tests. 

(b)  Phase  II  - This  phase  was  a formal  review  until  changed  by 
ASPO  letter  of  January  28,  1969,  which  authorized  the  RASPO-Downey  to 
approve  the  start  of  CSM  integrated  test  by  the  contractor. 

(c)  Phase  III  - Conducted  by  the  Director,  MSC,  immediately  prior 
to  shipment  to  identify  constraints  to  acceptance /shipment . It  is  a 
review  of  additional  data  from  Phase  I. 

Systems  Summary  Acceptance  Documents  (SSAD)  are  compiled  and  used 
by  Government  and  contractor  subsystem  review  teams  in  the  Phase  I CARP. 
There  are  44  of  these  documents  prepared  to  cover  the  subsystems  con- 
tained in  the  launch  escape  system,  command  module,  service  module,  and 
the  spacecraft-LM  adapter  (SLA).  Of  these,  l4  involve  the  service  mod- 
ule (SM)  and  there  are  separate  documents  for  the  environmental  control 
system  and  the  electrical  power  system  and  wiring,  which  include  the 
cryogenic  oxygen  tanks. 

SSAD  books  become  the  complete  and  official  historical  documents 
for  each  specific  CSM  subsystem.  Included  in  the  books  are  specific 
signed  statements  from  both  the  responsible  contractor  engineer  and  the 
NASA  Subsystem  Manager  certifying  the  readiness  of  the  specific  subsystem 
for  the  particular  phase  which  is  being  reviewed. 

The  Phase  III  CARR  is  concerned  only  with  documented  changes  since 
Phase  I.  This  concept  provides  a means  of  concentrating  on  only  those 
items  which  are  different  from  the  last  review  and  avoids  the  effort  which 
would  be  necessary  to  conduct  each  review  from  the  beginning  of  the  CSM 
history . 

At  the  completion  of  the  Phase  III  CARR,  the  CSM  is  ready  for  ship- 
ment to  the  KSC. 


Flight  Readiness  Reviews 

A Flight  Readiness  Review  (FRR)  for  the  CSM,  LM,  and  GSE  is  con- 
ducted at  MSC.  In  general,  this  review  is  similar  to  the  review  described 
in  the  CARR  plan.  The  same  systems  are  reviewed  by  similar  review  teams 
and  the  SSAD  books  are  continued.  However,  now  there  are  additional 
items  added  due  to  the  inclusion  of  the  ground  support  equipment  and  the 
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SLA.  Primary  continuity  is  obtained  by  use  of  the  SSAD  books , their 
updating  during  the  formal  FRR  and  subsequent  special  tests. 

An  FRR  Data  Review  is  held  at  KSC  to  prepare  for  the  formal  FRR 
Board  meeting  at  MSC . The  FRR  Board  is  chaired  by  the  Director  of  the 
MSC  or  his  deputy  and  includes  key  management  personnel  from  NASA  Head- 
quarters, MSC,  and  KSC.  The  review  objectives  are  to  determine  any 
action  required  to  bring  the  CSM/LM/GSE  to  a condition  of  flight  readi- 
ness . 


The  final  FRR  is  conducted  by  the  Office  of  Manned  Space  Flight  at 
KSC  approximately  5 weeks  before  the  scheduled  launch.  This  FRR  is 
chaired  by  the  NASA  Headquarters  Apollo  Program  Director  and  includes 
review  of  all  elements  of  the  mission. 


Launch  Minus  2-Day  Review 

This  review  is  chaired  by  the  Apollo  Mission  Director  with  all  the 
senior  manned  space  flight  officials  in  attendance.  This  review  is  held 
to  review  all  elements  of  the  mission  and  to  assure  closeout  of  all  items 
since  the  final  FRR. 


LAUNCH  CHECKOUT  PROCEDURES 


As  shown  by  figure  E6-2,  technical  control  of  the  hardware  remains 
with  MSC  during  the  checkout  and  test  operations  at  KSC.  However,  the 
KSC  is  specifically  responsible  for  conducting  the  tests  and  for  develop- 
ing appropriate  test  procedures  to  fulfill  the  test  requirements  estab- 
lished by  MSC. 

A Test  Requirements  Document  is  prepared  and  approved  by  MSC  (ref.  5). 
This  document  specifically  defines  the  following: 

1.  Test  Constraints  - the  test  sequencing  which  must  be  completed 
prior  to  accomplishment  of  particular  test  requirements  and  any  specific 
test  constraints. 

2.  Primary  Mission  Test  Requirements  Matrix  - matrices  are  listed 
by  system,  identifying  mandatory  test  requirements  that  must  be  satis- 
fied during  the  course  of  spacecraft  checkout  at  KSC.  Indication  is 
given  of  the  GSE  and  facility  locations  and  the  desired  test  guidelines 
are  referenced. 


Technical  / _ . . MSFC 

control  V Development  centers  


E-70 


Figure  E6-2.-  Mission  responsibility  relationships 


3.  Retest  Requirements  - the  general  requirements  for  spacecraft 
or  GSE  reverification  in  the  event  of  test  invalidation  because  of 
equipment  removal,  disconnecting,  repair,  etc. 

4.  Contingency  Test  Guidelines  - requirements. 

5.  Safety  Requirements. 

6.  Test  Guidelines  - these  specific  sheets  reflect  the  desired 
test  contents,  objectives,  and  test  prerequisites. 

7.  Alternate  Mission  Test  Requirements  - matrices  are  identified 
for  the  mandatory  test  requirements  that  must  be  satisfied  if  a CSM  is 
designated  to  perform  an  alternate  mission. 

Upon  receipt  of  the  Test  and  Checkout  Requirements  Document  from 
MSC,  KSC  prepares  a Test  and  Checkout  Plan.  This  plan  contains  the  out- 
line for  accomplishing  the  test  requirements  defined  by  MSC  at  the  launch 
site  and  additional  tests  which  the  KSC  considers  necessary  to  verify 
launch  facility,  manned  space  flight  network,  and  launch  crew  readiness 
or  to  satisfy  range  safety  requirements.  The  Test  and  Checkout  Plan 
(TCOP)  is  the  master  test  document  and  is  approved  by  both  KSC  and  MSC. 
Changes  to  this  plan  and  also  changes  to  the  facility  are  reviewed  and 
approved  by  the  KSC  and  MSC. 

Based  on  the  TCOP,  detailed  Test  and  Checkout  Procedures  (TCP)  are 
prepared  and  approved  by  KSC.  These  are  the  implementing  documents  which 
assure  that  correct  detailed  information  is  available  prior  to  the  con- 
duct of  any  test.  Changes  to  these  procedures  are  processed  on  control- 
led change  request  forms  which  are  signed  by  the  appropriate  authority. 
The  details  for  preparation,  release,  and  execution  of  the  TCP  are  con- 
tained in  Apollo  Preflight  Operations  Procedures  No.  0-202  and  0-221. 

Test  deviations  which  may  be  necessary  just  prior  to  the  start  or 
during  the  test  are  authorized.  However,  the  deviation  must  be  fully 
documented.  Review  in  this  case  takes  place  after  the  completion  of  the 
test,  but  it  is  still  reviewed  and  the  appropriate  levels  of  authority 
are  provided  with  the  opportunity  to  modify,  change,  or  to  have  the  tests 
rerun . 

Approximately  2 weeks  prior  to  the  scheduled  launch  date,  two  sepa- 
rate countdown  demonstration  tests  (CDDT)  are  conducted.  The  first  of 
these,  called  the  "wet"  CDDT,  involves  the  booster  and  tanking  of  all 
cryogenic  systems  in  all  modules.  This  countdown  runs  to  a simulated 
lift-off  and  is  then  concluded. 
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A second,  or  "dry,"  CDDT  is  conducted  shortly  after  the  "wet"  CDDT. 
This  CDDT  is  primarily  concerned  with  the  crew  functions.  The  cryogenic 
tanks  are  partially  detanked  during  this  CDDT. 

The  results  of  the  CDDT,  "wet"  and  "dry,”  are  reviewed  by  the  Mis- 
sion Director  and  the  decision  is  made  to  initiate  the  final  countdown. 

A final  review  is  conducted  with  all  of  the  senior  Manned  Space  Flight 
officials  at  the  Launch  Minus  2-day  Review.  At  this  point  the  mission 
is  firmly  committed. 
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PART  E7 


OXYGEN  TANK  MANAGEMENT  REVIEW 


GENERAL  TANK  HISTORY 


This  part  will  review  the  management  process  described  previously 
as  applied  to  the  design,  production,  test,  and  checkout  of  the  cryo- 
genic gas  storage  system  oxygen  tank. 

North  American  Rockwell  (NR)  established  tentative  requirements 
for  a cryogenic  gas  storage  system  and  issued  a request  for  proposal 
to  interested  companies  in  the  spring  of  1962.  In  the  summer  of  1962, 
Beech  Aircraft  Corporation  was  awarded  a letter  contract  to  design, 
develop,  and  qualify  the  Block  I Apollo  cryogenic  gas  storage  system. 
This  contract  was  awarded  after  evaluation  of  the  proposals  from  Beech 
and  a number  of  other  companies  with  cryogenic  experience.  The  origi- 
nal contract  for  Block  I was  scheduled  to  be  completed  by  January  1964, 
and  was  covered  by  NAA  Specification  MC  901-0005  (ref.  6). 

A considerable  amount  of  the  early  effort  was  expended  in  develop- 
ment of  a spherical  heater  pressurization  system  which  was  both  heavy 
and  electrically  complicated.  In  late  1963,  a program  was  established 
to  design  an  alternate  cryogenic  fan  motor  and  heater  system  which  was 
developed  and  approved  for  production  early  in  1964. 

The  primary  vendors  for  Beech  on  production  hardware  were  Parker 
Aircraft  for  valve  modules ; Cameron  Iron  Works  for  oxygen  tank  Inconel 
forgings;  Globe  Industries,  Inc.,  for  the  tank  motor  fans;  Simmonds 
Precision  Products,  Inc.,  for  instrumentation;  Airite  Division  of 
Sargent  Industries  for  pressure  vessel  tank  welding;  and  Metals  and 
Controls  Corporation  for  the  tank  heater  thermal  switches. 

In  1964,  the  state-of-the-art  for  insulation  of  supercritical 
oxygen  tanks  was  thoroughly  investigated  and  an  improved  concept  using 
dexiglass  paper  and  aluminum  foil  was  tested  and  found  satisfactory. 
Also,  the  boilerplate  BP-14  tanks  were  completed  and  shipped  to  NR  in 
1964. 


Block  II  competition  was  held  in  early  1965,  and  Beech  was  awarded 
this  contract  in  October  1965-  Beech  made  delivery  of  the  first  Block  I 
tank  in  December  1963,  and  the  last  one  in  1966.  There  was  therefore 
some  overlap  of  these  contracts. 

Preliminary  Design  Reviews  were  held  in  May  and  July  of  1965  by  NR 
and  Beech.  A Program  Review  was  held  in  December  1965  for  the  MSC 
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Apollo  Spacecraft  Program  Manager.  Because  of  the  tight  delivery 
schedule,  it  was  decided  at  the  Program  Review  to  assign  an  NR  team  to 
Beech  to  assist  in  assuring  meeting  tank  delivery  schedules.  The  con- 
figuration control  baseline  was  established  by  the  Critical  Design 
Review  held  in  March  1966  attended  by  NASA,  NR,  and  Beech  representa- 
tives. The  first  Block  II  oxygen  tanks  were  delivered  in  July  1966. 

A First  Article  Configuration  Inspection  (FACI)  was  conducted  November 
16-18,  1966,  with  NR,  Beech  and  NASA  participating.  The  FACI  confirmed 
the  configuration  baseline. 

The  original  specification  (ref.  6)  from  NR  to  Beech  for  procure- 
ment of  the  oxygen  tank  and  heater  assembly  was  dated  November  1962. 

No  reference  is  made  in  this  specification  to  other  than  design  for 
28  V dc.  Beech  issued  a specification  in  1963  to  Metals  and  Controls 
Corporation  for  procurement  of  the  thermal  switches  for  the  tank  heater 
assemblies.  These  thermal  switches  were  to  limit  the  tank  temperatures 
and  prevent  overheating  and  were  built  to  interrupt  the  28  V dc  space- 
craft current.  The  heater  GSE  was  subsequently  designed  and  built  by 
NR  with  a 65  V dc  power  supply  for  use  at  KSC  in  initial  pressurization 
of  the  oxygen  tanks.  The  65  V dc  current  was  used  in  order  to  pres- 
surize the  oxygen  tank  more  rapidly  than  could  be  done  with  the  28  V dc 
spacecraft  power  supply.  NR  issued  a revised  Block  II  specification 
(MC-9OI-O685 ) to  Beech  in  February  1965  which  specified  that  the  oxy- 
gen tank  heater  assembly  shall  use  a 65  V dc  GSE  power  supply  for 
tank  pressurization. 

Beech  issued  a specification  (1^56)  in  July  1965  to  Metals  and 
Controls  Incorporated  for  the  thermal  switches  for  the  Block  II  tanks. 
This  revised  Beech  specification  did  not  call  for  a change  in  the  ther- 
mal switch  rating  in  order  to  be  compatible  with  the  6 5 V dc  GSE  power 
supply.  (The  thermal  switch,  which  remains  closed  in  the  cold  liquid 
oxygen,  will  carry  the  65  V dc  current  but  will  not  open  without  dam- 
age with  65  V dc  applied. ) 

NR  or  Beech  never  subsequently  caught  this  discrepancy  in  the  GSE 
and  thermal  switch  incompatibility.  The  incompatibility  had  not  caused 
problems  previous  to  Apollo  13  since  the  thermal  switch  had  never  been 
called  upon  to  open  with  65  V dc  applied.  The  extended  heater  operation 
using  65  V dc  GSE  power  during  the  March  27  and  28  detanking  at  KSC 
raised  the  tank  temperature  to  80°  F and  called  for  the  thermal  switches 
to  open  for  the  first  time  under  these  conditions  (for  which  they  were 
not  designed  or  tested).  The  switch  malfunctioned  and  during  the  sub- 
sequent operation  did  not  provide  the  tank  overheating  protection  which 
the  KSC  test  personnel  assumed  existed. 

During  the  development  cycle  the  following  technical  problems  were 
encountered. 


Tank  Vacuum  and  Heat  Leak  Problems 


Poor  vacuum,  difficulty  in  acquiring  good  vacuum  on  initial  pump- 
down,  and  degradation  of  vacuum  from  outgassing  under  vibration  were 
encountered  early  in  the  program.  These  resulted  in  a high  heat  leak 
and  caused  excessive  rates  of  flow  and  pressure  rise.  Early  failures 
to  attain  satisfactory  initial  vacuum,  including  two  on  qualification 
tests,  were  corrected  by  revisions  to  test  procedures  to  extend  the 
heat  leak  stabilization  period  and  upgrade  methods  of  vacuum  acquisi- 
tion. 


Vacuum  pumping  equipment  was  also  modified  and  improved.  A speci- 
fication change  was  approved  by  NR  to  permit  an  adequate  but  more  real- 
istic value  of  heat  leak. 

Design  changes  were  made  in  order  to  correct  continued  difficulty 
in  securing  and  retaining  good  vacuum,  and  vac— ion  pumps  were  incor- 
porated as  an  integral  part  of  the  tank  assembly.  Use  of  the  vac-ion 
pump  prevented  further  gross  degradation  of  vacuum  from  outgassing. 

Part  of  the  heat  leak  was  attributed  to  variation  in  density  of  the 
load  bearing  insulation  in  the  tank  annulus.  The  insulation  was  re- 
designed to  reduce  the  allowable  weight  and  control  the  overall 
density  of  the  insulation. 

Heat  leak  did,  however,  remain  slightly  over  specification  on  some 
tanks,  and  these  minor  deviations  were  waived. 


Fan  Motors 

The  fan  motors  for  the  cryogenic  oxygen  experienced  a number  of 
failures  during  their  production  history.  A review  of  these  motors  was 
conducted  by  Globe  Industries,  Inc.,  and  Beech  Aircraft  Corporation. 

The  report  was  issued  in  January  1967- 

The  complete  manufacturing,  handling,  and  usage  of  the  fan  motors 
at  Globe,  Beech,  and  NR  was  reviewed  and  the  failures  that  had  occurred 
were  grouped  in  the  following  nine  failure  classes: 

1.  Contamination  failures 

2.  Bridge  ring  failures 

3.  Bearing  failures 

U.  Phase-to-phase  shorts 

5 . Grounds 
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6. 


Leadwire  damage 


7*  Speed 

8.  Coastdown 

9.  Miscellaneous 

Other  failures,  including  tolerance  build-ups,  were  reported  which 
could  not  be  classified  in  the  other  groups.  These  are  listed  under 
the  miscellaneous  classification.  The  corrective  actions  taken  as  a 
result  of  this  review  significantly  reduced  the  number  of  failures. 

One  apparent  flight  failure  in  an  oxygen  tank  fan  motor  occured  on 
Apollo  6.  The  failure  was  analyzed  as  a single-phase  short  to  ground 
in  the  heater  fan  motor  circuit.  Subsequently,  the  circuit  was  re- 
vised to  include  individual  fuse  protection  for  each  motor  and  single- 
phase circuit  breakers  in  each  phase. 


Vac-ion  Pump  and  Electromagnetic  Interference  (EMI)  Problems 

During  qualification  test  there  was  arcing  to  the  vac-ion  pump 
harness  at  a mounting  screw.  Increased  clearance  was  provided.  A 
continuity  check  was  added  to  verify  wiring.  Dielectric  leakage  between 
the  pump  and  the  tank  shell  also  occurred  at  the  vendor  plant.  A de- 
sign change  was  incorporated  adding  insulation  spacers  to  provide 
increased  clearances,  with  satisfactory  results. 

The  use  of  the  vac-ion  pump  led  to  EMI  with  other  systems  on  the 
spacecraft.  Corona  discharge  and  arcing  of  the  high  voltage  lead  and 
connector  occurred.  This  was  identified  during  altitude  chamber  test 
of  spacecraft  101  at  KSC.  The  fix  initiated  was  to  modify  the  shield- 
ing of  the  high-voltage  lead  and  improve  the  potting  in  the  connector. 

The  vac-ion  pump  is  normally  not  used  during  flight.  It  has  only 
been  used  during  vehicle  assembly  and  checkout  to  assure  that  the 
proper  vacuum  is  maintained  on  the  oxygen  tank  annulus.  The  circuit 
breakers  for  these  pumps  are  opened  prior  to  flight. 


Heater  Failures 

Electrical  shorting  in  the  heater  circuit  occurred  twice.  A heater 
element  caused  a short  during  acceptance  test  of  a Block  I tank  at  the 
vendor’s  plant.  A circuit  breaker  tripped  20  minutes  after  power  was 
applied.  The  short  was  caused  by  damage  to  the  insulation  of  the  heater 
lead  wires.  It  was  apparently  scraped  during  installation  of  the  wires 
into  the  tank  or  during  handling  prior  to  installation.  Improved  in- 
spection and  installation  procedures  and  a pin-to-pin  insulation 
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resistance  test  were  initiated.  During  qualification  testing  the  heater 
lead  wire  was  burned  and  a circuit  breaker  was  tripped  by  overload.  The 
cause  was  faulty  solder  joints  made  during  installation.  Improved  fab- 
rication techniques  were  put  in  effect,  and  applied  to  all  Block  II 
tanks . 

During  this  period  of  design,  development,  test,  and  manufacture, 
there  had  been  coordination  meetings  of  Beech  personnel  with  the  NR  and 
NASA  representatives.  By  the  end  of  1966,  the  tanks  had  completed  the 
major  cycle  of  development  and  qualification  and  about  30  tanks  had  been 
delivered.  In  1967 > 17  additional  tanks  were  delivered,  three  were  de- 
livered in  1968,  and  six  were  delivered  in  1969.  These  deliveries  es- 
sentially completed  the  contract  except  for  eight  tanks  remaining  at 
Beech.  In  addition,  11  tanks  were  used  during  the  early  development 
period  for  qualification  and  tests,  making  75  tanks  in  all.  Of  these 
75  tanks,  28  were  in  Block  I and  47  in  Block  II. 


CHRONOLOGY  OF  APOLLO  13  OXYGEN  TANK 


The  specific  tank  assembly  of  interest  in  this  review  is  oxygen 
tank  no.  2 of  CSM  109-  This  tank  is  identified  as  ME  282-0046-008 
serial  number  10224XTA0008.  The  other  tank  on  the  oxygen  shelf  of 
CSM  109  was  serial  number  10024XTA0009 • 

The  end-item  acceptance  data  package  (ref.  7)  contains  the  config- 
uration and  historical  data  relative  to  this  particular  tank.  Using 
these  data  and  pertinent  spacecraft  review  data,  it  is  possible  to  trace 
this  tank  through  its  manufacture,  reviews,  discrepancies,  and  tests  to 
launch  as  a part  of  an  approved  flight  system. 

The  Cameron  Iron  Works  made  a rough  forging  of  top  and  bottom  tank 
hemispheres  in  accordance  with  Beech  specifications  and  provided  the 
required  microstructure  analysis  of  the  grain  size  of  the  Inconel  718 
hemisphere  and  evidence  of  satisfactory  ultrasonic  and  radiographic 
inspection.  The  forgings  were  shipped  to  the  Airite  Division  of 
Electrada  Corporation,  El  Segundo,  California,  for  machining  and 
welding.  After  machining,  pressure  vessel  wall  thickness  measurements 
were  made  on  the  upper  and  lower  hemispheres  at  about  300  points  to 
establish  that  girth  and  membrane  measurements  were  within  specified 
tolerances.  The  two  hemispheres  were  then  welded  together.  X-rayed  for 
weld  inspection,  and  shipped  to  Beech  Aircraft  Corporation  on  June  15, 
1966.  Beech  Aircraft  installed  the  probe,  quantity  and  temperature 
sensor,  furnished  by  Simmonds  Precision  Products,  Inc.,  and  cryogenic 
fan  motors  furnished  by  Globe  Industries,  Inc.  Beech  also  installed 
the  tank  insulation  and  outer  Inconel  shell. 
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During  the  manufacture  and  testing  of  the  tank  0008  at  Beech,  a 
number  of  discrepancies  recorded  as  Material  Review  Records  were  reported 
and  corrected.  These  discrepancies  included: 

1.  The  upper  fan  motor  was  noisy  and  drew  excessive  current.  Cor- 
rective action  was  to  remove  both  fan  motors  and  replace  them  with  new 
motors  serial  numbers  7C30  and  70^1. 

2.  The  vac-ion  pump  assembly  insulator  was  found  to  have  two  small 
cracks  along  the  weld  bead.  Corrective  action  was  to  grind  off  the  pump 
assembly  and  insulation  weld,  to  remove  and  replace  the  insulator  and 
reweld  the  assembly. 

3.  During  the  minimum  flow  tests,  the  oxygen  flow  rate  was  found 
to  be  0.8l  lb/hr  as  compared  to  0.715  lb/hr  specified  as  maximum  in  the 
NR  specification.  A waiver  was  requested  for  this  and  three  other  tanks 
that  exhibited  similar  flow  rates.  Waiver  CSM  00M  was  approved  by 
Apollo  Project  Engineering  at  NR  and  by  the  Acting  Manager,  Resident 
Apollo  Program  Office  (RASP0)  in  accordance  with  standard  procedures. 

The  tank  was  subjected  to  the  specified  end-item  acceptance  check, 
including  vac-ion  functional  test,  heater  pressurization  test,  electrical 
insulation  resistance  tests,  dielectric  strength  tests,  proof  and  purge 
tests,  and  minimum  oxygen  flow  tests.  These  tests  were  all  satisfactorily 
completed,  with  the  exception  of  the  slightly  excessive  oxygen  flow  rate 
previously  discussed,  and  are  documented  in  the  End-Item  Acceptance 

Data  Package  Book  (ref.  7). 


Handling  Incident 

The  tank  was  shipped  to  NR,  inspected,  and  then  installed  on  an 
oxygen  shelf  in  June  1968.  This  shelf  was  subsequently  installed  in 
CSM  106.  The  vac-ion  pump  modification,  previously  discussed,  could 
not  be  performed  with  the  tank-shelf  assembly  installed  in  a service 
module.  For  this  reason,  the  oxygen  shelf  was  removed  from  CSM  106. 
During  the  removal  sequence  the  shelf  handling  fixture  broke  and  the 
shelf  was  dropped  approximately  2 inches.  After  the  modification 
and  appropriate  inspections,  the  shelf  assembly  was  reassigned  to  CSM 
109- 


DR's  were  written  to  require  inspection  and  test  of  the  shelf 
assembly  for  recertification.  These  inspections  and  tests  revealed 
no  major  discrepancies.  It  was  reported  by  NR  that  an  engineering 
analysis  was  performed  to  determine  the  forces  which  might  have  been 
imposed  on  the  tanks  due  to  the  "shelf  drop."  This  analysis  indicated 
that  the  loads  were  within  the  design  limits  of  the  tanks  and  that  no 
internal  damage  should  have  been  sustained.  This  informal  report  is 
not  now  available  from  existing  files. 


To  verify  that  the  internal  components  of  the  tanks  were  functional, 
a series  of  tests  were  conducted.  The  tanks  were  given  a repeat  of  the 
acceptance  and  verification  tests  which  are  normally  conducted  by  NR 
prior  to  installation  of  an  oxygen  shelf  in  a service  module.  All  of 
these  tests  were  passed  successfully,  with  no  significant  changes  from 
the  previous  test  results.  NR  does  not  fill  the  tanks  with  liquid  oxygen 
during  their  test,  assembly,  and  checkout  activities  at  the  plant. 

At  the  completion  of  the  required  vac-ion  pump  modifications  and 
successful  test  results  obtained,  the  shelf  assembly  condition 
was  reviewed  by  NR  engineering,  R&QA,  and  the  RASPO  and  installed  in 
CSM  109.  All  appropriate  signatures  were  obtained  on  the  DR's,  copies 
of  these  were  provided  to  the  Subsystem  Manager  at  MSC,  and  copies  were 
also  included  in  the  Subsystem  Summary  Acceptance  Document  (SSAD)  book 
for  spacecraft  109* 

At  the  Phase  I CARR  for  CSM  109,  November  18-19,  1968,  the  incident 
was  again  discussed  by  the  CARR  subsystem  team  with  NR  engineering  and 
NASA/RASPO.  Documents  and  NR  test  results  were  reviewed  and  the  shelf 
was  accepted.  It  had  passed  all  required  tests,  the  analysis  indicated 
that  estimated  loads  had  not  exceeded  design  limits,  and  the  entire 
record  had  been  properly  reviewed.  The  incident  had  been  explained  in 
accordance  with  all  of  the  management  control  systems  in  effect. 

The  Phase  III  CARR  on  May  26-28,  1969,  verified  that  the  shelf  was 
installed  in  CSM  109  and  that  test  data  verified  satisfactory  oxygen 
shelf  performance  in  accordance  with  the  test  DR  written  by  NR  and 
NASA/RASPO. 

The  information  concerning  the  handling  incident  was  included  in 
the  SSAD  books  for  spacecraft  109*  It  was  not  reviewed  by  the  Flight 
Readiness  Review  (FRR)  Board.  Equipment  which  has  successfully  passed 
all  tests  and  has  been  certified  as  flightworthy  does  not  require 
additional  reviews  unless  additional  problems  are  discovered.  As  no 
problems  were  encountered,  the  CSM  109  FRR  on  January  15-16,  1970, 
considered  the  oxygen  shelf  checkout  as  having  been  satisfactorily  per- 
formed and  recommended  the  system  as  flight  ready. 

Because  the  handling  incident  had  occurred  early  in  the  review 
cycle  for  spacecraft  109  and  had  been  closed  out,  it  was  not  recon- 
sidered in  any  detail  during  the  decision  process  regarding  the 
detanking  incident.  NR  personnel  at  Downey  were  aware  of  the  handling 
incident.  However,  Beech,  KSC,  and  senior  MSC  Management  were  unaware 
of  the  incident. 
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The  R&QA  reporting  and  data  retrieval  system  is  designed  to  enable 
records  to  be  readily  obtained.  However,  this  is  not  an  automatic 
action.  It  is  necessary  for  the  concerned  people  to  initiate  the 
action;  that  is,  request  the  record  search.  By  virtue  of  the  general 
concept  that  is  applied  to  Apollo,  this  search  of  the  records  is 
seldom  done.  Flight  equipment  is  either  flightworthy  or  not.  There 
is  no  gray  area  allowed  between  good  and  bad  equipment. 


Detanking  Incident 

After  shipment  to  KSC,  build-up  checkout  activities  proceeded 
normally  until  the  countdown  demonstration  test  ( CDDT ) sequence  where- 
in the  tanks  were  pressurized,  checked,  serviced  with  liquid  oxygen, 
and  then  detanked.  Detanking  difficulty  developed  during  sequence  29- 
009  of  Test  and  Checkout  Procedures  (TCP),  TCP-K-0007V2 , at  10:55  p.m. 
on  March  23 > 1970,  when  oxygen  tank  no.  2 did  not  decrease  to  about 
50  percent  quantity  as  expected. 

The  problem  was  first  attributed  to  a faulty  filter  in  the  asso- 
ciated ground  support  equipment  (GSE)  and  an  Interim  Deficiency  Report 
(IDR  023)  was  initiated  for  evaluation  of  the  filter. 

Troubleshooting  of  test  sequence  29  was  continued  by  the  NR 
Systems  Engineers,  the  NASA  (KSC)  Systems  Engineers,  and  the  NR  Sys- 
tems Specialist  with  the  actions  monitored  by  a KSC  reliability 
specialist  and  a KSC  safety  specialist  in  accordance  with  specified 
KSC  procedures. 

A decision  was  made  on  March  23,  1970,  at  11:37  p.m.  that  TCP-K- 
0007V2  test  procedures  could  be  continued.  This  decision  was  made  by 
the  NR  Systems  Engineer,  NASA  (KSC)  Systems  Engineer,  and  the  NR  Systems 
Specialist. 

TCP-K-0007V2  was  continued  through  sequence  29-014  by  2:55  a.m.  on 
March  24,  and  the  IDR  023  was  upgraded  to  a GSE/Discrepancy  Report  (DR) 
for  filter  evaluation  on  March  24,  1970. 

The  TCP-K-0007V2  test  sequence  29  was  reinitiated  on  March  27,  1970, 
at  which  time  it  was  known  that  the  suspect  GSE  filter  was  not  malfunc- 
tioning. An  Interim  Discrepancy  Report  (IDR  040)  was  written  to  inves- 
tigate detanking  and  change  detanking  procedures  to  assist  in  detanking. 
After  substantial  time  was  spent  in  the  detanking  attempt,  the  IDR  040 
was  changed  to  a spacecraft  DR  0512. 
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A conference  including  MSC  subsystems  engineers  and  KSC  Apollo  CSM 
Manager  was  held  and  a Beech  engineer  was  contacted  by  telephone  to 
discuss  the  problem.  It  was  decided  that  the  difficulty  was  caused  by 
allowable  looseness  in  a fill  line  fitting  and  it  was  decided  to  try 
detanking  using  fans  and  heater  on  oxygen  tank  no.  2.  This  was  started 
on  March  27?  1970,  during  the  second  shift. 

DR  0512  was  signed  by  the  NR  Systems  Engineer,  the  NASA  Systems 
Engineer,  and  the  NR  Systems  Specialist  (all  of  whom  are  assigned  to ^ 
KSC),  and  varied  the  procedures  of  the  basic  TCP.  This  variation  did 
not  result  in  satisfactory  detanking. 

DR  0512  was  further  amplified  on  March  28,  1970,  at  about  4 a.m., 
to  provide  for  a pressure  pulsing  technique  whereby  the  tank  vent  was 
closed  and  the  tank  was  pressurized  to  300  to  340  psig,  allowed  to  sta- 
bilize for  5 minutes,  and  then  vented  through  the  fill  line.  This  pro- 
cedure was  concurred  in  at  the  time  by  NR  Systems  Engineer,  NASA  Systems 
Engineer,  NR  Systems  Specialist,  and  NR  Systems  Manager,  all  of  whom 
are  assigned  to  KSC.  This  procedure  was  followed  for  five  pressure  cy- 
cles and  the  tank  was  emptied. 

The  decision  to  be  made  by  KSC  in  consultation  with  NR  and  MSC  was 
whether  to  leave  the  oxygen  shelf  in  the  spacecraft  or  to  exchange  it 
for  a different  one.  This  was  a critical  decision  because  changing  a 
major  unit  such  as  the  oxygen  shelf  at  the  KSC  is  not  a normal  practice. 
It  can  be  accomplished,  but  it  must  be  done  manually  at  some  risk  of 
damage  to  adjacent  components.  At  the  NR  factory,  there  is  a specifi- 
cally designed  item  of  GSE  with  which  to  remove  the  shelf. 

Many  telephone  calls  were  made  concerning  the  detank  problem,  and 
several  of  them  were  conference  hookups  so  that  most  of  the  participants 
could  hear  the  entire  conversation.  The  KSC  Director  of  Launch  Opera- 
tions and  the  MSC  Apollo  Spacecraft  Program  Manager  led  the  ensuing 
investigation  which  included  key  technical  experts  at  Beech,  similar 
experts  at  NR,  and  the  subsystems  managers  at  MSC. 

During  the  weekend  beginning  March  27?  MSC  developed  a comprehen- 
sive checklist  of  questions  which  had  to  be  answered  prior  to  making  a 
decision  concerning  the  oxygen  tank: 

1.  Details  and  procedures  for  normal  detanking  at  Beech  and  KSC. 

2.  Details  of  abnormal  detanking  at  KSC  on  March  27  and  28. 

3.  Hazards  resulting  from  a possible  loose  fill  tube  in  the  oxygen 

tank. 
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4.  Can  the  tank  be  X-rayed  at  KSC? 

5.  Could  loose  tolerances  on  the  fill  tube  cause  the  detanking 
problem? 

6.  Should  a blowdown  and  fill  test  be  made  on  the  tank? 

7.  Disassemble  both  oxygen  tanks  from  Service  Module  2TV-1  and 
examine  components . 

All  of  the  checklist  questions  were  answered  by  test,  analysis, 
and  inspection.  The  report  of  the  Beech  investigation,  contained  in 
reference  8,  included  the  following  conclusions: 

1.  ,fBased  on  manufacturing  records,  the  Teflon  tube  fill  line 
assembly  was  installed. 

2.  Total  gap  areas  in  the  assembly  after  cooldown  could  vary  from 
0.004  in2  to  0.09  in2  from  tank  to  tank. 

3-  Based  on  allowable  tolerances,  gap  areas  on  tanks  could  approach 
the  area  of  3/8  inch  fill  line,  thus  accounting  for  the  inability  to  de- 
tank per  methods  used  at  KSC. 

4.  Normal  stresses  on  the  Teflon  plug  are  not  sufficient  to  cause 
cracking  or  breakout  of  the  plug. 

5.  The  assembly,  fabricated  to  print  dimensions,  cannot  come  apart 
in  the  installation. 

6.  Tank  X-rays  are  not  clear  enough  to  show  the  fill  assembly. 

7.  The  delta  pressure  across  the  coil  assembly  and  disconnect 
is  very  small. 

8.  Energy  level  developed  by  shorting  capacitance  plates  on  probe 
is  too  low  to  cause  a problem.” 

In  addition  to  these  conclusions,  Beech  also  provided  NR  a copy  of 
their  detanking  test  procedures  and  the  calculations  used  to  reach  their 
conclusions . 

Based  upon  the  Beech  information,  the  condition  of  the  2TV-1  oxygen 
tank  fill  line  determined  by  direct  inspection  and  the  understanding 
that  the  detank  procedures  at  the  KSC  and  at  Beech  were  different,  it 
was  concluded  that  the  tank  was  flightworthy.  The  primary  participants 
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in  reaching  this  conclusion  were  the  NR  CSM  Program  Manager,  the  KSC 
Director  of  Launch  Operations,  and  the  MSC  ASPO  Manager.  The  fact  that 
these  people  did  not  have  complete  or  correct  information  to  use  during 
the  decision  process  was  not  determined  until  after  the  accident. 

The  information  which  subsequent  review  determined  to  be  incomplete 
or  incorrect  included  the  following: 

1.  Neither  the  KSC  Launch  Operations  Director  nor  the  MSC  ASPO 
Manager  knew  about  the  tank  handling  incident  which  had  occurred  at 
NR- Downey. 

2.  The  last  portion  of  the  detanking  procedure  at  Beech  is  similar 
to  that  used  by  KSC.  No  one  appeared  to  be  aware  of  this  similarity  be- 
tween the  procedures.  At  one  time  during  the  early  portions  of  the  pro- 
gram they  were,  in  fact,  different. 

3.  All  of  the  key  personnel  thought  that  the  oxygen  tank  on  Service 
Module  2TV-1  had  experienced  detanking  problems  similar  to  those  experi- 
enced at  KSC.  As  this  tank  was  available,  it  was  disassembled  and  in- 
spected. The  examination  of  the  internal  tank  parts  showed  a loose- 
fitting  metal  fill  tube  and  it  was  concluded  that  this  loose  fit  was 

the  cause  of  the  detanking  problem.  Subsequent  review  has  revealed 
that  the  2TV-1  tank  probably  detanked  in  a normal  manner. 

k.  The  senior  managers  were  not  aware  that  the  tank  heaters  had 
been  left  on  for  a period  of  8 hours.  It  appears  this  information  was 
provided  to  NR- Downey  by  telephone  during  a long  conversation.  However, 
it  was  not  considered  during  the  decision  process.  No  one  at  MSC,  KSC, 
or  NR  knew  that  the  tank  heater  thermostatic  switches  would  not  protect 
the  tank  from  overheating. 

The  management  system  alerted  the  right  people  and  involved  them 
in  providing  technical  information  to  the  responsible  program  managers. 
Communications  were  open,  unrestricted,  and  appear  to  have  been  nearly 
continuous.  All  of  the  modified  KSC  detank  procedures  were  correctly 
documented  and  other  reports  were  correctly  filled  out.  The  problem 
was  that  inaccurate  and  misleading  information  was  provided  to  the 
managers . 

Any  consideration  of  whether  management  decisions  would  have  been 
different  if  the  correct  data  had  been  provided  is  highly  speculative. 
However,  it  is  likely  that  requests  for  additional  tests  or  data  may 
have  been  considered  during  the  discussion  if  the  correct  information 
had  been  available. 


This  page  left  blank  intentionally. 
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PART  E8 


OXYGEN  TANK  MATERIAL  SELECTION 


The  original  design  of  the  cryogenic  oxygen  storage  system  was 
based  on  state-of-the-art  existing  in  1962  and  subsequent  developments 
during  the  course  of  the  contract  test  and  evaluation  phase.  The  tank 
contractor,  Beech  Aircraft,  Boulder,  Colorado,  started  the  design  using 
materials  considered  compatible  based  on  existing  cryogenic  knowledge. 

A limited  program  was  followed  in  qualifying  components,  such  as  the 
Globe  fan  motors  in  the  company’s  test  facilities. 

The  first  formal  application  of  Nonmetallic  Materials  Selection 
Guidelines  was  imposed  on  NAA  by  CCA  1361  dated  April  17,  1967.  This 
Change  Authorization  required  that  the  contractor  implement  ASPO-RQTD- 
D67-5A  dated  April  17,  1967,  and  recommend  a detailed  plan  for  analysis, 
application  testing,  selection,  and  approval  of  nonmetallic  materials  to 
assure  that  all  potentially  combustible  applications  are  identified  and 
controlled.  In  addition,  the  contractor  was  required  to  recommend  any 
design  and/or  material  changes  necessary  to  meet  these  criteria.  This 
change  was  effective  on  Spacecraft  2TV-1,  101,  and  subsequent. 

The  cryogenic  oxygen  gas  storage  system  was  categorized  as  Category 
D — Material  Applications  in  High  Pressure  Oxygen  System--for  material 
selection  and  control  purposes. 

Requirements  for  Category  D are  as  follows:  This  category  shall 

include  those  materials  used  in  greater  than  20  psia  oxygen  systems. 
Materials  shall  have  prior  use  history  in  oxygen  service,  with  no  fire 
or  explosion  experience. 


FUNCTIONAL  DESCRIPTION 


Materials  for  such  applications  as  filters,  seals,  valve  seats,  and 
pressure  bladders  shall  be  covered  by  these  criteria. 


Material  Property  Requirements 
Propagation  rate.-  No  test  required. 

Thermogravimetri c analysis  and  spark  ignition  test,  reference  9. — 
This  test  is  designed  to  determine  the  weight  loss  and  outgassed  vapor 
spark  ignition  characteristic  of  materials  under  test.  A material  evolv- 
ing significant  vapors  verified  by  weight  loss  and  having  a visible  flash 
at  a temperature  less  than  U00°  F is  unacceptable.  A material  that  shows 
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evidence  of  charring  or  sustaining  combustion  at  a temperature  less  than 
450  F is  unacceptable , A material  that  shows  evidence  of  charring  or 
sustaining  combustion  at  a temperature  less  than  450°  F is  unacceptable 
for  use  in  crew  bay  areas. 

Odor,  carbon  monoxide,  and  organics,  reference  9.-  Materials  shall 
be  tested  for  carbon  monoxide  and  total  organics.  If  the  material  yields 
oyer  25  micrograms  of  carbon  monoxide  per  gram  of  material  or  over  100 
micrograms  of  total  organics  per  gram,  it  will  be  rejected.  If  it  passes 
this  test,  it  will  be  evaluated  for  objectionable  odor  by  a test  panel 
of  5 to  10  members.  If  the  odor  is  objectionable,  the  material  will  be 
unacceptable . 

Friction  and  impact  ignition,  reference  9- - This  test  is  to  deter- 
mine the  sensitivity  and  compatiability  of  nonmetallic  materials  with 
pure  oxygen  for  use  in  the  high-pressure  oxygen  system.  Only  materials 
that  have  passed  other  required  tests  will  be  subject  to  this  test.  The 
material  will  be  subjected  to  three  successive  tests  at  1.5  kilogram 
meters  impact  testing  at  successively  higher  gaseous  oxygen  pressures 
until  a reaction  is  observed  by  discoloration,  evidence  of  combustion, 
or . detonation.  To  be  acceptable,  the  material  must  not  show  a reaction 
at  the  maximum  use  pressure  plus  2000  psi. 

Friction  and  impact  ignition. - Materials  shall  not  ignite  when 
tested  to  the  requirements  of  Appendix  D of  reference  10. 

The  presently  applicable  contractual  specification  (ref.  9)  was 
published  and  placed  on  contract  by  CCA  2147  to  record  the  criteria  and 
requirements  actually  in  force  for  the  Apollo  contract.  Modifications 
to  the  basic  document  are  made  as  the  knowledge  increases,  and  it  was 
last  revised  in  November  1969. 

The  contractor  is  primarily  responsible  for  the  selection  of  mate- 
rials in  contractor  furnished  equipment  (CFE)  as  prescribed  by  contract. 
NASA  publishes  materials  selection  requirements  and  reviews  materials 
selected  by  the  contractor.  A Material  Selection  Review  Board  is  estab- 
lished at  the  contractor's  facility  to  review  material  selection  and  to 
approve  or  reject  all  deviation  requests.  The  contractor  board  submits 
all  decisions  to  the  Material  Review  Selection  Board  at  MSC  for  review 
and  approval.  The  prime  board,  MSC,  indicates  concurrence  or  noncon- 
currence to  the  contractor  board  within  5 days  of  receipt  of  the  lower 
board's  decisions. 

Present  requirements  for  material  selection  are  essentially  the 
same  as  those  previously  cited  and  are  listed  in  detail  in  reference  10. 
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Materials  Listing 


A listing  of  materials  was  prepared  by  Beech  and  furnished  to  NR. 
The  listing  was  checked  at  NR  for  completeness  and  compatibility  and 
entered  into  the  Characteristics  of  Materials  (COMAT)  list  and  forwarded 
to  MSC  in  October  1969.  This  COMAT  package  was  transmitted  to  the 
MSC/GE  Materials  Engineering  Support  Unit  where  it  was  reviewed  and 
signed  off  as  complete  and  accurate  by  the  Materials  Engineering  Unit 
Manager.  All  materials  are  shown  to  be  compatible  for  the  use  contem- 
plated except  Drilube  822  which  is  an  assembly  lubricant  used  in  very 
small  quantities.  The  MSC  COMAT  shows  this  material  classed  as  requir- 
ing the  submission  of  a Material  Usage  Agreement  (MUA)  for  approval. 

The  Drilube  was  judged  acceptable  for  the  use  contemplated  in 
accordance  with  the  blanket  waiver  given  for  outgassing  of  materials 
tested  at  MSC  on  the  2TV-1  and  CSM  101  vehicles. 


This  page  left  blank  intentionally. 
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SAFETY  AND  RELIABILITY  AND  QUALITY  ASSURANCE  (R&QA) 
INTRODUCTION  AND  ORGANIZATION 


General 

The  Apollo  Program  has  a firmly  established  safety  requirement  in 
the  basic  program  objective.  The  original  objective  of  the  program  was 
to  land  men  on  the  Moon  and  return  them  safely  to  the  Earth,  The  pro- 
gram management,  design,  review,  and  monitoring  procedures  described  in 
previous  sections  of  this  Appendix  are  designed  to  assure  that  all 
program  problems,  including  safety,  are  presented  to  the  appropriate 
management  decision  makers  at  selected  program  maturity  points. 

The  safety  system  and  organization  is  designed  to  provide  an  inde- 
pendent specialized  monitoring  and  evaluation  function  for  the  program 
line  management.  The  following  figures  and  descriptions  of  responsi- 
bilities outline  the  safety  organization  of  NASA  as  it  applies  to  the 
Apollo  Program,  and  the  contractor-subcontractor  organization  as  it 
applies  to  the  Apollo  Program  generally,  and  the  cryogenic  gas  storage 
system  specifically. 


NASA  Headquarters 

The  Aerospace  Safety  Advisory  Panel  is  established  to  provide  a 
direct,  nonorganizational  overview  on  safety  for  all  programs  for  the 
Administrator  (fig.  E9-l).  The  charter  for  this  panel  specifies  access 
to  any  program  information  necessary  for  their  safety  audit  function 
and  full  support  of  their  requirements  by  the  NASA  Safety  Officer  and 
other  elements  of  the  organization. 

The  NASA  Director  of  Safety  is  responsible  for  exercising  functional 
management  authority  and  responsibility  over  all  NASA  safety  activities. 
This  includes  development  of  policy,  procedures  to  implement  policies, 
and  review  and  evaluation  of  conformance  to  established  policy.  He  is 
also  charged  with  supporting  Program  Directors  and  Instutional  Directors 
in  discharging  their  safety  responsibilities.  His  review  and  concurrence 
are  required  for  the  safety  portion  of  each  Project  Plan  and  Project 
Approval  Document. 

The  NASA  Director  of  Safety  reports  to  the  Associate  Administrator 
for  Organization  and  Management. 
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Figure  E9-1.-  National  Aeronautics  and  Space  Administration 


The  office  of  the  Associate  Administrator  for  Manned  Space  Flight 
(MSF)  (fig.  E4-3)  has  several  offices  with  either  a primary  or  secondary 
responsibility  for  safety. 

The  Director,  Manned  Space  Flight  Safety  Office,  has  a dual  organi- 
zational responsibility  to  the  Associate  Administrator  for  Manned  Space 
Flight  (AA/MSF)  for  program  guidance  and  policy  direction.  He  also 
serves  in  the  office  of  the  NASA  Safety  Director  as  Assistant  Safety 
Director  for  Manned  Space  Flight  Programs,  assisting  in  the  development 
of  overall  NASA-wide  safety  policy,  guidance,  and  professional  safety 
standards.  In  this  NASA  Assistant  Safety  Director  assignment,  he  is 
under  the  cognizance  of  the  Office  of  Organization  and  Management.  In 
accomplishing  his  responsibility  as  Manned  Space  Flight  Safety  Director, 
he  advises  the  MSF  Program  Directors  and  the  AA/MSF  on  all  matters  in- 
volving manned  flight  safety  and  develops  and  documents  appropriate 
safety  policy  for  these  programs.  He  audits  the  program  offices  and 
MSF  Field  Centers  to  insure  compliance  with  established  policy  and  de- 
velops accident  investigation  and  reporting  plans  for  use  in  the  event 
of  flight  anomalies.  He  also  develops  the  Manned  Space  Flight  Awareness 
Program. 

Bellcom,  Inc.,  is  under  contract  to  AA/MSF  to  perform  studies, 
technical  fact  finding  and  evaluation,  analytical  investigations,  and 
related  professional  activities  in  support  of  Manned  Space  Flight  Pro- 
grams. In  support  of  the  Apollo  Program,  this  contract  capability  is 
available  under  the  direction  of  the  Director,  Apollo  Program,  for  safety 
studies  or  analyses  as  required  in  support  of  his  responsibilities  to 
systematically  identify  hazards  and  risks  and  take  all  practical  meas- 
ures to  reduce  risks  to  acceptable  levels. 

Manned  Space  Flight  Mission  Directors  are  assigned  as  Deputy  Program 
Directors  for  specific  missions  and  are  responsible  for  insuring  thorough 
inter-Center/OMSF  coordination  for  that  mission.  The  Mission  Director 
insures  that  consideration  is  given  to  all  problems  and  proposed  changes 
affecting  safety  and  to  advise  the  Program  Director  of  any  disagreement 
with  proposed  actions  from  the  standpoint  of  assuring  quality  hardware 
and  flight  safety. 

The  Director,  Mission  Operations,  is  responsible  for  directing  and 
evaluating  the  development  of  the  total  operational  capability  necessary 
for  the  conduct  and  support  of  Manned  Space  Flight  missions.  These 
responsibilities  are  performed  in  support  of  the  Manned  Space  Flight 
Program  Directors  under  the  cognizance  of  the  Associate  Administrator 
for  Manned  Space  Flight.  In  accomplishing  this  operational  responsibil- 
ity, the  Mission  Operations  Director  works  with  the  MSF  Director  of 
Flight  Safety  to  insure  development  of  operation  safety  plans. 
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The  Director  of  Reliability  and  Quality  Assurance  is  responsible  to 
the  Assistant  Administrator  for  Industry  Affairs  to  formulate  and  develop 
reliability  and  quality  assurance  policies  and  to  prescribe  guidance  and 
procedures  to  implement  approved  policies.  He  is  also  responsible  for 
assessing  the  effectiveness  of  these  programs  throughout  the  Agency  and 
for  keeping  the  management  informed  of  the  status  of  the  program.  He 
participates  in  investigations  of  major  accidents  and  mission  failures 
whenever  reliability  and  quality  assurance  could  have  been  a contribut- 
ing factor.  He  also  initiates  and  conducts  special  studies  of  problems 
affecting  the  reliability  and  quality  of  NASA  hardware. 

The  Director,  Manned  Spacecraft  Center,  under  the  supervision  of 
the  AA/MSF,  manages  the  development  activities  of  the  Apollo  Program, 
with  emphasis  on  providing  spacecraft,  trained  crews,  and  space  flight 
techniques.  In  carrying  out  these  functions,  he  procures  spacecraft 
systems  and  monitors  and  directs  contractor  activities.  He  also  selects 
and  trains  flightcrews,  establishes  mission  and  test  requirements,  and 
plans  and  executes  missions  under  the  direction  of  the  Mission  Operations 
Director . 

The  Director,  John  F.  Kennedy  Space  Center  (KSC),  under  the  super- 
vision of  the  AA/MSF , develops,  operates,  and  manages  the  Merritt  Island 
Launch  Area  (MILA)  and  assigned  programs  at  the  Eastern  Test  Range  (ETR) 
and  insures  that  KSC  operations  meet  the  requirements  of  NASA  Safety 
Standards . 


Manned  Spacecraft  Center 

The  Safety  Office  is  the  focal  point  for  the  development,  implemen- 
tation, and  maintenance  of  a safety  program  at  MSC.  The  office  implements 
requirements  established  by  NASA  Headquarters,  maintains  a current  MSC 
Safety  Plan  and  Manual,  and  participates  as  an  advisor  to  the  Director, 
MSC,  in  major  spacecraft  reviews.  The  office  assesses  the  effectiveness 
of  contractors  in  their  safety  functions  and  assists  MSC  directorates, 
program  offices,  and  contractors  in  safety  matters. 

The  Safety  Office  is  functionally  divided  into  a number  of  sub- 
divisions to  accomplish  their  assigned  duties,  as  shown  in  figure  E9-2. 

The  Manned  Flight  Awareness  Office  is  responsible  for  developing  a 
motivational  program  to  instill  in  each  individual  associated  with 
manned  space  flight  a personal  awareness  of  their  responsibility  for  the 
lives  of  the  astronauts  and  mission  success  of  space  flight  missions. 

This  responsibility  is  largely  accomplished  by  development  and  publica- 
tion of  motivational  literature  and  by  scheduling  and  coordinating  astro- 
naut and  management  official  visits  to  contractor  and  subcontractor 
plants  in  support  of  the  Manned  Flight  Awareness  Program. 
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Figure  E9-2.-  MSC  Safety  Office  organization. 


The  Program  Management  Safety  Office  develops  and  applies  a system 
safety  program  for  flight  hardware  contracts.  System  safety  guidelines 
are  identified  to  MSC  program  offices  and  directorates  and  through  them 
to  contractors.  The  Program  Management  Safety  Office  represents  the 
Manager,  Safety  Office,  on  program  major  milestone  reviews  and  evaluates 
contractor  and  MSC  system  safety  requirements  for  particular  programs. 
This  office  also  provides  for  identification  and  tracking  of  hazards 
throughout  the  life  of  a system.  In  accomplishing  this  responsibility, 
the  office  assesses  mission  rules,  flight  plans,  and  crew  procedures  to 
identify  potential  hazards  and  assure  that  they  are  eliminated  or  con- 
trolled. They  also  evaluate  design  and  procedure  changes  for  safety 
implications  and  monitor  space  flight  missions  in  real  time  to  appraise 
the  Manager,  Safety  Office,  of  safety-related  amonalies.  They  maintain 
close  interface  with  MSC  program  elements  to  provide  inputs  for  trade- 
offs involving  safety  and  performance. 

The  Test  Operations  Safety  Office  is  the  subdivision  of  the  Safety 
Office  that  establishes  a safety  program  to  insure  the  safe  conduct  of 
hazardous  tests  involving  human  subjects,  tests  of  GFE  astronaut  equip- 
ment, and  special  tests  of  spacecraft.  The  office  evaluates  test  facili- 
ties and  operations  to  determine  hazardous  activities  and  provides  test 
officers  for  activities  considered  to  be  of  an  extremely  hazardous 
nature.  They  compile  and  evaluate  reports  and  findings  of  Operational 
Readiness  Inspections  (ORI’s)  and  distribute  these  reports  as  required. 

The  System  Safety  Office  develops,  implements,  and  maintains  a 
system  safety  program  for  manned  spacecraft  efforts  involving  prelimi- 
nary analysis,  definition,  and  design  phases.  The  office  also  provides 
system  safety  support  for  other  elements  of  the  Safety  Office.  Speci- 
fically, this  office  assists  in  the  preparation  of  system  safety  plans 
from  the  initial  purchase  order  or  request  for  proposal  through  the 
procurement  stage  and  then  audits  the  system  safety  activities  of  the 
contractor  or  MSC  organizational  element  throughout  the  program. 

The  Industrial  Safety  Office  directs  and  coordinates  comprehensive 
industrial,  public,  and  traffic  safety  programs,  including  a fire  preven- 
tion and  protection  program  and  an  ordnance  safety  program  covering  MSG 
operations  and  activities  including  test  facilities;  develops  and  coor- 
dinates the  MSC/contractor  industrial  safety  program;  and  evaluates  the 
effectiveness  of  all  MSC-directed  industrial  safety  activities. 

The  Reliability  and  Quality  Assurance  Office  at  MSC  (fig.  E9-3)  is 
a fundamental  element  in  the  safety  system.  The  office  is  co-located 
with  the  Safety  Office  and  the  same  man  heads  both  offices.  The  R&QA 
office  develops  and  implements  the  reliability  and  quality  assurance 
programs  for  the  Center  to  assure  that  spacecraft,  spacecraft  systems, 
and  supporting  systems  are  designed  and  built  to  perform  satisfactorily 
in  the  environment  for  which  they  are  designed.  This  office  also  reviews 
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and.  evaluates  R&QA  information  and  activities  of  contractors  and  provides 
onsite  monitoring.  The  office  also  provides  specialized  studies  for 
safety  reviews  and  provides  direct  support  to  program  managers  for  design 
reviews,  configuration  management  change  control,  flight  readiness  re- 
views, and  real-time  mission  support. 

The  MSC  Safety  Plan  establishes  the  organized  MSC  system  safety  pro- 
gram. The  plan  applies  to  Center  activities  and  contractors  under  NASA/ 
MSC  direction.  The  plan  is  oriented  toward  spacecraft  systems  and  crew 
safety  and  does  not  cover  all  elements  of  a total  safety  program. 

The  general  intention  of  the  safety  program  is  to  establish  the  pri- 
mary responsibility  for  safety  of  spacecraft  and  GSE  hardware  and  soft- 
ware with  the  program  office/contractor.  The  responsible  directorates 
are  recognized  as  having  the  primary  responsibility  for  the  safety  of 
mission  operation  and  crew  procedures.  The  MSC  Safety  Office  has  the 
primary  responsibility  for  assessing  manned  safety  of  spacecraft  flight 
and  ground  testing  and  acting  to  insure  system  safety  consideration  by 
all  MSC  and  program  contractor  elements. 

The  MSC  offices  and  directorates  with  prime  system  safety  responsi- 
bilities are  shown  in  figure  E9-3  with  their  functional  relationships 
with  the  Safety  Office  indicated  by  the  dashed  lines.  Each  of  these 
offices  and  directorates  has  established  a single  point  of  contact  for 
all  safety  matters.  This  contact  interfaces  directly  with  the  Safety 
Office  and  has  unimpeded  access  to  top  management  of  his  directorate  or 
office  on  safety  matters.  The  spacecraft  hardware  and  operations  safety 
responsibilities  of  each  of  these  offices  are  as  follows: 

1.  Program  offices  manage  the  design,  test,  and  manufacture  of 
spacecraft  systems  and  related  GSE  to  assure  proper  contractual  safety 
requirements.  They  implement  Safety  Office  policies  and  procedures  and 
resolve  incompatibilities  between  mission  requirements,  mission  profiles, 
operational  constraints,  and  spacecraft  capabilities.  They  also  provide 
the  basis  for  certifying  design  maturity  and  manned  flight  safety. 

2.  Flight  Operations  Directorate  is  responsible  for: 

(a)  Trajectory  and  flight  dynamics  analysis. 

(b)  Mission  control  requirements. 

(c)  Mission  rules  and  spacecraft  systems  handbooks. 

(d)  Ground  instrumentation  requirements. 

(e)  Emergency  real-time  procedures. 


(f)  Landing  and  recovery  testing  and  operations.  Coordinating 
recovery  operations  with  DOD. 

(g)  Coordinating  safety  matters  with  Air  Force  Eastern  Test 

Range . 

(h)  Providing  the  basis  for  certifying  design  maturity  and 
manned  flight  safety. 

3.  Flight  Crew  Operations  Directorate: 

(a)  Assures  the  adequacy  of  flightcrew  selection  and  training. 

(b)  Establishes  crew  procedures  and  spacecraft  operational 
constraints . 

(c)  Conducts  mission  planning. 

(d)  Establishes  crew  station  design  requirements. 

(e)  Conducts  simulations  (nominal  operations  and  abort). 

(f)  Develops  operations  handbooks  and  general  flight  procedures. 

(g)  Approves  all  KSC  test  and  checkout  operating  procedures 
involving  flightcrews. 

(h)  Conducts  and  supports  tests  with  aircraft  where  they  are 
used  to  develop  and  evaluate  operational  capabilities  of  space-related 
hardware  and  operations. 

(i)  Provides  the  basis  for  certifying  design  maturity  and 
manned  flight  safety. 

b.  The  Engineering  and  Development  Directorate: 

(a)  Assures  the  adequacy  of  design,  manufacture,  and  test  of 
equipment  and  the  cognizance  of  this  Directorate. 

(b)  Assures  that  safety  is  properly  integrated  and  that  system 
safety  requirements  are  provided  in  contractual  requirements. 

(c)  Provides  technical  support  to  MSC  programs  through  sub- 
system management  programs . 
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5.  The  Science  and  Applications  Directorate: 

(a)  Performs  flight  experiments  and  special  experimental  tasks. 

(b)  Assures  proper  integration  of  system  safety  policies  and 
requirements  into  design  and  operation  of  all  space  science  experiments. 

(c)  Coordinates  with  Safety  Office  on  safety  requirements  for 
special  experiments. 

(d)  Assures  that  safety  requirements  are  properly  implemented 
in  the  design  and  operation  of  the  Lunar  Receiving  Laboratory. 

(e)  Provides  the  basis  for  certifying  design  maturity  and 
manned  flight  safety. 

6.  The  Reliability  and  Quality  Assurance  Office: 

(a)  Supplies  failure  mode  and  effect  analysis  of  spacecraft 
systems,  subsystems,  GFE,  and  experiments. 

(b)  Provides  failure  trends. 

(c)  Determines  safety  categories. 

(d)  Coordinates  with  Government  inspection  agencies  to  insure 
that  safety-critical  items  satisfy  established  requirements. 

(e)  Approves  failure  closeout  statements. 

7.  The  Medical  Research  and  Operations  Directorate: 

(a)  Provides  world- wide  medical  support  for  manned  missions 
and  provides  flight  surgeons  during  missions. 

(b)  Provides  medical  coverage  for  all  tests  involving  human 

subjects . 

(c)  Monitors  the  physical  condition  of  human  participants 
with  the  authority  to  stop  testing  if  continuation  might  result  in 
injury  or  death  to  the  test  subject. 

(d)  Ascertains  by  physical  examinations  the  satisfactory  phy- 
sical condition  of  the  test  personnel  or  flightcrews  and  certify  their 
satisfactory  physiological  condition. 

(e)  Participates  in  test  planning  and  approves  all  physiologi- 
cal test  standard  procedures  involving  human  participants. 


(f)  Establishes  the  physiological  limits  to  which  man  can  be 
subjected, 

(g)  Reviews  plans  and  changes  for  construction  of  test  facili- 
ties involving  humans. 

(h)  Has  responsibility  for  biological  safety  during  Lunar 
Receiving  Laboratory  operations. 

The  Safety  Office  also  maintains  a safety  interface  between  MSA 
Headquarters,  MSC,  other  centers,  and  other  Government  agencies  as  shown 
in  figure  E9-4.  The  areas  of  safety  coordination  with  these  organiza- 
tions are  described  as  follows.  In  the  event  problems  arise  at  these 
interfaces,  interagency  panels  will  be  convened  for  problem  resolution. 

MSC/KSC  interface  in  eight  areas  that  are  safety  oriented  or 
related: 

1.  Test  operations  at  KSC. 

2.  Flight  hardware  management. 

3.  Flightcrew  activities  at  KSC. 

4.  Configuration  control. 

5.  Quality  control  and  inspection  at  KSC. 

6.  Safety  at  KSC. 

7.  Experiment  management. 

8.  Launch  and  flight  operations. 

Any  problems  which  arise  are  resolved  through  the  formally  orga- 
nized intercenter  panels. 

MSC/DOD  Safety  Regulations  are  primarily  at  the  Air  Force  Eastern 
Test  Range  Facility.  DOD  provides  the  following  functions: 

1.  Safety-related  base  support  as  required: 

(a)  Fire  protection  and  control 

(b)  Explosive  ordnance  disposal 
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Figure  E9-*+.-  MSC  interrelationship  with  other  organizations 

safety  offices. 


2. 


(c)  Bioenvironmental  engineering 

(d)  Security- 

Missile  ground  safety  as  required. 

3.  Range  safety. 

1+.  Search  and  sea  recovery. 

John  F.  Kennedy  Space  Center 

The  Kennedy  Space  Center  takes  the  test  and  checkout  requirements 
and  test  and  checkout  specifications  and  criteria  documents  prepared  by 
the  development  centers  and  develops  plans  and  procedures  for  the  hand- 
ling and  launch  of  spacecraft.  To  accomplish  this  responsibility,  KSC 
prepares  and  coordinates  Test  and  Checkout  Plans  and  implementing  Test 
and  Checkout  Procedures. 

The  KSC  Safety  Office.-  This  office  plans  and  manages  an  integrated 
hazard-assessment  and  risk- reduction  program  for  all  activities  at  KSC 
and  for  all  NASA  activities  at  both  Cape  Kennedy  Air  Force  Station 
( CKAFS ) , Florida,  and  Vandenburg  Air  Force  Base  (VAFB),  California. 

This  program  includes: 

1.  Handling,  storing,  and  transporting  hazardous  items  such  as 
missile  propellants,  ordnance,  high-pressure  gases,  toxic  fluids,  and 
radi oacti ve  devi ces . 

2.  Insuring  safety  requirements  are  included  in  all  contracts 
initiated  or  administered  by  KSC  and  that  contractor  performance  is 
periodically  evaluated. 

3.  Performing  engineering  system  safety  studies  to  assure  inclu- 
sion of  safety  requirements  in  engineering  design  of  space  vehicle  test 
and  checkout  (launch  complex  and  ground  support  equipment /facilities  and 
operations ) . 

U.  Insuring  that  safety  controls  and  required  support  are  in  effect 
during  performance  of  all  operations. 

5 . Approving  siting,  construction,  and  modification  plans  for  safety 
aspects . 

The  office  conducts  safety  surveillance  while  selected  operations 
are  actually  in  progress,  with  authority  to  halt  activities  under  speci- 
fied circumstances . 
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Prior  to  publication  of  a test  and  checkout  procedure  (TCP)  for 
(a)  operational  checkout  of  flight  hardware,  (b)  functional  verification 
and  operational  control  of  GSE,  and  (c)  operational  instructions  to  ser- 
vice, handle,  and  transport  end-item  flight  hardware  during  prelaunch 
and  launch  operations,  the  KSC  Safety  Office  reviews  and  approves  these 
procedures  to  assure  that  operations  are  compatible  with  KSC  safety 
criteria  and  use  appropriate  safety  personnel,  techniques,  and  equipment. 

Prior  to  publication  of  a technical  procedure  involving  hazardous 
operations  to  (a)  authorize  work,  (b)  provide  engineering  instructions, 
and  (c)  establish  methods  of  work  control,  the  KSC  Safety  Office  re- 
views and  approves  the  procedure  to  assure  that  operations  are  compat- 
ible with  KSC  safety  criteria  and  use  appropriate  safety  personnel, 
techniques,  and  equipment. 

During  selected  operations  that  involve  hazardous  sequences,  the 
Safety  Office  has  representatives  on  site.  In  the  case  of  major  inte- 
grated tests,  i.e.,  CDDT,  the  number  of  representatives  can  be  as  high 
as  12,  with  three  people  on  station  in  the  Launch  Control  Center  firing 
room  and  the  remainder  at  various  positions  on  the  launch  pad.  The 
safety  representative  insures  that  safety  requirements  are  implemented, 
approves  or  disapproves  on-the-spot  changes  to  Category  I procedures 
made  either  by  Procedure  Change  Request  (PCR)  or  Deviation  Sheets  and 
assists  the  test  supervisor  in  obtaining  resolution  on  matters  that 
have  safety  overtones. 


North  American  Rockwell  Corporation  - Space  Division 

The  NR  System  Safety  Plan  for  the  Apollo  CSM  program  is  the  imple- 
menting document  for  the  program  required  by  MSC  specification  under  the 
basic  CSM  contract. 

The  objective  of  the  system  is  the  elimination  or  control  of  risks 
to  personnel  and  equipment  throughout  the  manufacture,  checkout,  and 
flight  missions  of  the  Apollo  CSM.  To  achieve  this  objective  the  CSM 
system  safety  program  has  an  organization  as  shown  in  figure  E9-5.  The 
CSM  System  Safety  Office  reports  directly  to  the  CSM  General  Manager 
and  is  headed  by  the  Assistant  to  the  General  Manager  for  CSM  System 
Safety.  The  Assistant  to  the  General  Manager  for  CSM  System  Safety  acts 
for  the  General  Manager  in  the  conduct  of  activities  relating  to  all 
facets  of  safety  for  the  CSM  programs,  and  is  a permanent  member  of  the 
Space  Division  Safety  Committee.  He  directs  and  monitors  program  activ- 
ities necessary  to  assure  an  effective  system  safety  program.  He  is 
responsible  for  preparation  and  compatibility  of  the  CSM  system  safety 
programs  at  all  sites  with  the  exception  of  Launch  Operations  at  KSC. 
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Figure  E9-5.-  Apollo  CSM  System  Safety  Program  organization. 


Specific  responsibilities  of  the  NR  CSM  Safety  Office  include: 

1.  Develop  and  direct  the  system  safety  program  for  the  CSM 
programs . 

2.  Participate  in  Customer  Acceptance  Readiness  Reviews  (CARR’s) 
and  Flight  Readiness  Reviews  (FRR's)  and  assess  problems  submitted  for 
flightcrew  safety  impact . 

3.  Supervise  the  three  CSM  functional  departments  relative  to 
system  safety  and  interface  with  other  agencies  and  divisions  of  NR 
concerning  CSM  safety. 

4.  Participate  as  a member  of  the  NR  Change  Control  Board  (CCB) 
to  review  proposed  changes  and  assure  changes  do  not  jeopardize  ground 
and  flightcrew  safety. 

5.  Maintain  status  report  system  on  all  safety  problems  and  design 
changes  affecting  safety. 

The  Engineering  Division  System  Safety  Office: 

1.  Reviews  and  evaluates  safety  effect  of  all  Engineering  Design 
Change  (EDC)  packages. 

2.  Reviews  and  assesses  engineering  analyses  such  as  FMEA's,  SPF's, 
and  similar  documents  for  identified  hazards  which  jeopardize  crew 
safety.  Evaluate  their  corrective  action  and  disposition. 

3.  Participates  in  postflight  evaluations  when  requested  by  MSC 
for  evaluation  of  crew  safety  problems. 

The  Manufacturing  Division  System  Safety  Office: 

1.  Provides  safety  checklists  to  aid  manufacturing  personnel  in 
preparing  documents  and  conducting  safety  surveys. 

2.  Assures  that  CSM  manufacturing  test,  handling,  and  transport 
procedures  and  work  documents  contain  appropriate  system  safety 
provisions . 

3.  Assures  that  operations  defined  as  safety-critical  are  ade- 
quately planned  and  monitored. 
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The  Test  Operations  System  Safety  Office  is  responsible  for  protec- 
tion of  the  operational  integrity  of  the  CSM  during  checkout  at  Downey 
and  testing  at  field  sites.  This  office: 

1.  Generates  system  safety  checklists  for  preparing  Test  Operations 
and  conducting  safety  surveys. 

2.  Reviews  all  test,  checkout,  and  operations  procedures  for  ade- 
quate system  safety  requirements. 

3 . Reviews  all  safety-critical  operations  to  assure  adequacy  of 
test  set-up,  documentation,  and  personnel  qualification.  Assures  that 
adequate  emergency  plans  and  procedures  are  established  and  in  use  for 
these  safety-critical  operations. 

4.  Coordinates  crew  safety  provisions  and  requirements  and,  when 
appropriate,  recommends  corrective  action  for  identified  hazards 
associated  with  crew  procedures. 

The  Safety  Plan  appears  to  be  operating  satisfactorily  according 
to  the  most  recent  MSC  audit.  The  multiple  safety  offices  and  fragmen- 
ted responsibilities  warrant  a critical  review  aimed  at  evaluating  the 
expected  effectiveness  of  a more  centrally  managed  program. 

The  Reliability  and  Quality  Assurance  function,  as  shown  in  figure 
E9-5?  has  a functional  responsibility  to  the  corporate  quality  office 
and  a program  management  responsibility  to  the  CSM  Program  Manager. 

They  are  responsible  for  monitoring  the  manufacturing  orders  for  proper 
R&QA  callouts,  verification  inspection  callouts,  planned  inspection 
callouts,  and  proper  implementation  of  R&QA  requirements  in  the  planning 
operation.  They  also  compile  the  System  Summary  Acceptance  Documents 
(SSAD's)  for  Customer  Acceptance  Readiness  Reviews  (CARR’s)  and  Flight 
Readiness  Reviews  (FRRTs),  They  conduct  quality  inspections  on  manufac- 
turing processes  and  testing  operations  and  participate  in  design  re- 
views. They  also  verify  material  usage  and  make  and  dispose  of  failed 
hardware . 

The  reliability  function  monitors  design  specifications  and  pre- 
pares failure  effects  and  criticality  analyses.  They  develop  and  super- 
vise maintainability  analyses,  perform  failure  reporting  analyses  and 
recommend  corrective  action,  support  end-item  reviews,  perform  problem 
investigations,  and  support  the  problem  items. 


Beech  Aircraft  Corporation 

The  overall  organization  of  the  Beech  Aircraft  Corporation,  Boulder 
Division,  is  shown  in  figure  E4-11,  and  a functional  breakdown  of  the 
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office  of  the  Apollo  Program  is  shown  in  figure  E4-12.  The  Beech  Quality 
Control  Plan  establishes  the  detailed  methods  and  procedures  for  accom- 
plishing the  positive  quality  control  required  by  NASA  of  its  contrac- 
tors and  subcontractors  in  the  Apollo  Program.  The  Beech  plan  does 
comply  with  the  NASA  requirements  of  NPC-200-2,  ’'Quality  Program  Pro- 
visions for  Space  Systems  Contractors”  (ref.  ll),  and  is  applicable  to 
the  material,  parts,  components,  subassemblies,  installations,  and  sys- 
tem and  subsystems  purchased,  tested,  and  manufactured  for  the  Apollo 
supercritical  gas  storage  system. 

The  system  operates  to  assure  maintenance  of  the  basic  approved 
configuration  baseline  by  reviewing  and  documenting  materials,  processes, 
vendor-provided  equipment,  testing  procedures,  and  manufacturing  opera- 
tions . 

The  Beech  Reliability  Program  Plan  provides  for  management  and  opera- 
tion of  the  reliability  system.  It  provides  for  the  monitoring  and 
reporting  of  all  tests,  and  maintenance  of  a complete  record  of  action 
on  discrepancies  and  failures;  and  participates  in  corrective  action  and 
research  required  for  Failure  Mode  Effects  Analysis  (FMEA)  analyses, 
logic  diagrams,  math  models,  and  reliability  predictions  and  apportion- 
ments. Documentation  of  these  efforts  are  furnished  to  the  NR  and  NASA 
to  fulfill  contract  requirements.  The  Beech  Aircraft  reliability  and 
quality  assurance  organization  and  operation  appear  to  be  adequate  and 
in  compliance  with  contract  and  NPC-200-2  requirements.  Manufacturing 
procedures  and  process  control  were  surveyed  and  found  in  good  condition 
and  documentation  such  as  the  FMEA’s  was  examined  and  found  to  be 
satisfactory. 


SAFETY  AND  R&QA  AUDITS 


Regular  audits  of  the  Safety  and  R&Q/V  functional  areas  are  made  of 
the  field  centers  by  NASA  Headquarters  teams.  The  Centers,  in  turn, 
make  similar  audits  of  their  prime  contractors.  These  contractors  con- 
duct audits  and  survey  visits  with  their  subcontractors  and  suppliers. 
In  addition,  the  NASA  Aerospace  Safety  Advisory  Panel  has  reviewed  cer- 
tain aspects  of  the  manned  space  flight  safety  program.  These  reports 
are  included  in  the  Apollo  13  Review  Board  files. 

Consideration  of  these  audits  and  reviews  by  the  Management  Panel 
showed  no  significant  items  relative  to  the  Apollo  13  accident.  The 
general  functioning  of  the  overall  Safety  and  RScC^V  programs  was  found 
to  be  consistent  with  good  practices. 
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MSC  safety/r&qa  participation 


The  MSC  Safety  Office  is  responsible  for  implementing  safety  poli- 
cies and  assuring  safety  in  design,  development,  and  operation  of  space- 
craft. The  R&QA  function  is  responsible  for  assuring  that  spacecraft 
and  supporting  systems  are  designed  and  built  to  perform  in  the  environ- 
ment for  which  they  are  built.  The  two  functions,  Safety/R&QA,  are 
mutually  dependent,  have  many  common  information  and  data  requirements, 
and  have  many  review  and  monitoring  functions  that  support  them  both. 

Safety/R&QA  are  closely  involved  in  the  entire  design,  development, 
test,  and  flight  phase  of  all  spacecraft  components,  systems,  and  sub- 
systems. This  includes  participation  in  formal  reviews  such  as  the 
Preliminary  Design  Reviews  (PDR),  Critical  Design  Reviews  (CDR),  First 
Article  Configuration  Inspection  (FACl),  and  Customer  Acceptance  Readi- 
ness Reviews  (CARR)  conducted  by  the  Program  Office.  Safety/R&QA  also 
participates  in  Design  Certification  Reviews  (DCR)  and  Flight  Readiness 
Reviews  (FRR). 

These  offices  implement  general  policy  and  establish  specific  pro- 
grams for  contractors.  They  then  monitor  these  programs  throughout  the 
contract  period  to  assure  safety  and  quality  of  performance  by  the 
contractor . 

This  review  considered  some  of  the  activities  of  these  two  offices 
from  the  CARR  through  the  post- touchdown  phase  of  the  command  and  ser- 
vice module  of  Apollo  13. 

CARR's  are  held  in  two  phases  at  present:  Phase  I prior  to  the 

initiation  of  subsystem  testing  and  Phase  III  prior  to  shipping  the 
assembled  vehicle.  MSC  R&QA  reviewed  documentation  for  Phase  III  CARR 
for  CSM  109  with  the  following  specific  results. 


Phase  III  CARR  for  CSM  109 

1.  No  hardware  will  exceed  its  allowable  operational  storage  limits 
during  KSC  operation  and  flight. 

2.  No  known  parts  problems  exist  that  will  constrain  shipment  of 
CSM  109. 

3.  There  are  854  Certification  Test  Requirements  (CTR's)  for  equip- 
ment applicable  to  CSM  109.  Testing  is  incomplete  for  six  and  certifi- 
cation will  not  be  complete  at  time  of  delivery.  This  status  is  sig- 
nificantly better  than  previous  CSM’s,  however,  and  shows  an  improving 
trend. 
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4.  An  improving  trend  in  spacecraft  quality  was  shown  by  a review 
of  NR-Downey  discrepancy  reports  on  CSM  109. 

5.  Verification  of  nonmetallic  materials  has  been  accomplished  and 
establishes  that  all  exposed  nonmetallic  materials  have  been  identified 
and  approved  or  deviations  written  and  accepted. 

6.  All  known  single-point  failures  applicable  to  CSM  109  have  been 
reviewed  and  are  acceptable . 

A comparison  of  data  shown  in  the  R&QA  review  for  CSM  109  and  pre- 
vious CSM  spacecraft  shows  that  CSM  109  has  shown  substantial  improve- 
ment in  most  R&QA  and  safety  categories  and  no  decrement  in  safety  in 
any  area. 


FRR  R&QA  Summary 

The  next  formal  review  was  the  Apollo  13  Flight  Readiness  Review 
(FRR). 

1.  All  limited-life  items  adequate  to  support  flight. 

2.  No  known  electrical,  electronic,  or  electromechanical  problems 
exist  that  would  constrain  launch. 

3.  No  Certification  Test  Requirements  constrain  flight,  since  all 
have  been  approved  except  one  which  will  be  certified  by  analysis  prior 
to  flight. 

4.  All  known  single-point  failures  have  been  reviewed  and  are 
considered  acceptable . 

5.  The  overall  quality  of  CSM  109  shows  a favorable  trend  relative 
to  previous  spacecraft. 

The  Flight  Safety  assessment  at  the  FRR  was: 

6.  The  system  safety  assessment  of  planned  mission  flight  activi- 
ties and  spacecraft  functions  disclosed  no  safety  concerns  that  would 
constrain  the  Apollo  13  flight  scheduled  for  launch  on  April  11,  1970. 

7.  Four  changes  from  previous  missions  have  been  made  which 
reduced  flight  risks. 

8.  The  risks  unique  to  Apollo  13  involve;  (a)  programming  S-IVB 
stage  for  lunar  impact  during  translunar  coast;  (b)  performing  lunar 
descent  orbit  insertion  with  CSM/LM  docked;  (c)  operating  power  drill  on 
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lunar  surface;  and  (d)  performing  PLSS  communication  degradation  test 
during  lunar  surface  EVA.  These  risks  are  not  of  constraining  magnitude. 


Weekly  Safety/R&QA  Report 

In  addition  to  the  formal  CARR,  FRR,  and  other  reviews,  information 
is  furnished  to  the  Apollo  Program  Office  and  the  Director,  MSC,  on  a 
weekly  basis  of  the  activity  of  Safety  and  R&QA  relative  to  particular 
spacecraft  through  the  Weekly  Activity  Reports.  Abbreviated  mention  of 
some  items  from  this  Weekly  Report  from  January  1970  to  April  10,  1970, 
concerning  the  Apollo  13  and  CSM  109  follows. 

January  8-15,  1970.-  Thirteen  open  certification  items  for  Apollo  13 
were  reported.  Pacing  items  are  four  lunar  camera  items  scheduled  to  be 
closed  in  February. 

January  15-22,  1970.-  CSM  109  FRR  data  review  generated  10  R&QA 
Review  Item  Dispositions  (RID's).  CSM  109  FRR  subsystem  working  session 
was  conducted  at  KSC  on  January  15-l6.  FRR  RID’s  were  generated  and 
submitted  for  preboard  action  on  January  25.  Readiness  statements  were 
prepared  for  CSM  109 . 

January  22-28,  1970.-  An  assessment  of  CSM  104  through  109  failures 
at  KSC  was  conducted.  Detailed  assessment  will  be  made  to  determine 
reasons  failures  were  not  discovered  at  NR  before  shipment. 

Safety  Office  briefed  Astronaut  Conrad  on  proposed  procedure  change 
for  Mode  4 abort.  Conrad  will  review  with  other  astronauts,  including 
Apollo  13  Commander. 

January  30-February  4,  1970.-  Ground  support  equipment  (GSE)  at 
KSC  supporting  CSM  109  is  defective  and  may  provide  a countdown  demon- 
stration and  countdown  constraint  unless  the  situation  is  remedied.  NR 
is  studying  the  problem.  The  Apollo  13  Safety  Assessment  Study  of  Mis- 
sion Phases  from  translunar  injection  through  CSM  descent  orbit  injec- 
tion has  been  completed  and  will  be  distributed  by  February  4,  1970. 

The  biweekly  meeting  of  MSC  Safety/Boeing  System  Safety  on  Apollo  mission 
concerns  was  held  January  30.  Seventeen  Apollo  13  safety  concerns  were 
reviewed.  Eight  of  the  seventeen  were  closed. 

February  12-18,  1970.-  R&QA  and  Apollo  Test  Division  met  to  discuss 
anomaly  reporting  effort.  The  discussion  disclosed  no  duplication  of 
effort  and  agreement  was  reached  that  the  Apollo  Mission  Anomaly  Test 
would  be  the  guide  for  anomaly  investigations.  As  of  this  date,  only 
one  GSE  problem  is  open.  It  is  expected  to  be  resolved  by  the  CDDT . 
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February  19-26,  1970.-  The  Safety  Offices  Assessment  Report  for 
Apollo  13  has  been  prepared.  There  are  no  constraining  items  in  the 
report . 

February  26-March  3,  1970.-  The  Apollo  13  R&QA  Flight  Readiness 
Assessment  Report  was  completed  February  26,  1970.  R&QA  agrees  with  the 
data  and  conclusions  drawn.  Of  the  five  items  listed  as  requiring  veri- 
fication, only  one  (referring  to  LM-7  rate  gyro)  is  still  active  and 
should  be  resolved  March  6.  The  Safety  Office  Assessment  Report  was 
presented  at  MSC's  FRR  on  February  26,  1970.  No  constraining  items 
exist.  Two  items  are  to  be  presented  involving  crew  procedures. 

March  20-26,  1970.-  An  R&QA  review  will  be  held  during  the  after- 
noon and  evening  before  the  Apollo  13  launch  to  reaffirm  launch,  and 
results  will  be  discussed  with  the  CSM  Manager.  The  mission  plan  and 
information  notebook  for  the  Apollo  13  mission  is  being  prepared  for 
Safety  and  R&QA  mission  support.  The  Safety  Office  provided  the  Deputy 
Manager  with  a written  assessment  of  an  R&QA  single-point  0PS/PLSS 
leakage  failure.  The  Crew  Systems  Division  is  aware  of  the  problem  and 
is  developing  a work-around  procedure. 

April  3-9j  1970.-  Open  problems  with  potential  Apollo  13  effectiv- 
ity  continue  to  be  worked.  Last  planned  status  report  to  ASP0  is  sched- 
uled for  April  10,  1970.  It  is  anticipated  that  all  open  problems  will 
be  closed  or  explained  by  that  time . 

April  10-16,  1970.-  Final  Apollo  13  Single  Failure  Point  Summary 
was  made  during  this  time  and  approved  by  subsystem  manager.  All  re- 
ported problems  effective  against  Apollo  13  were  closed  or  explained 
prior  to  launch.  Also,  all  ALERTS  for  Apollo  13  were  closed  prior  to 
launch.  R&QA  and  Safety  activities  have  been  mainly  to  support  changes 
in  the  mission  brought  about  by  loss  of  the  oxygen  supply. 


Apollo  13  Mission  Real-Time  Activities 

The  Safety/R&QA  functions  support  the  premission  and  mission  activ- 
ities of  Apollo  flights  in  real  time.  The  purpose  of  this  support  is 
twofold.  First,  the  Safety/R&QA  personnel,  both  in-house  and  contract, 
provide  a contact  for  the  mission  group  to  call  on  for  specialized  sup- 
port at  any  time  during  the  mission  from  launch  minus  9 days  through 
splashdown.  There  are  also  specialized  R&QA/Safety  personnel  available 
at  the  contractor's  plants,  NR  and  Grumman,  for  consultation  as  required. 
Secondly,  the  Safety/R&QA  people  are  monitoring  mission  activities  to 
make  independent  safety  assessments  and  evaluations  for  future  crew  safety 
and  mission  readiness  purposes.  For  this  purpose,  the  monitoring  team 
maintains  a log  of  problems  and  occurrences  that  is  used  to  prepare  a 
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support  anomaly  list  that  is  later  resolved  with  the  Project  Test 
Division  in  the  preparation  of  the  Mission  Anomaly  list.  The  Safety/ 
R&QA  support  operation  for  the  Apollo  13  mission  included  the  following 
activities: 

Prelaunch.  - 


Daily  problem  closeout  meeting:  Meetings  were  held  daily  to  review 

the  status  of  hardware  problems,  certification  tests,  limited-life 
items,  and  other  pertinent  reliability  concerns  to  assure  that  all 
potential  problems  had  been  properly  evaluated  and  resolved.  Head- 
quarters R&QA  was  also  represented  at  these  meetings. 

R&QA/Safety  status  meeting:  A meeting  of  R&QA  and  Safety  per- 

sonnel was  held  on  Friday  evening,  April  10,  1970,  to  review  the 
status  of  all  known  and  potential  problems  on  Apollo  13.  The  meeting 
was  chaired  by  the  Manager,  Safety  and  R&QA  Offices.  Following  the 
meeting,  the  CSM  Project  Manager  was  informed  of  the  results  of  the 
meeting.  Headquarters  R&QA  was  represented  at  the  meeting. 

Daily  launch  readiness  problem  report:  This  was  initiated 

February  9>  1970,  and  the  final  report  was  issued  on  the  morning 
of  April  11,  1970,  indicating  no  open  problems  against  Apollo  13 
hardware . 

Daily  bulletins:  Apollo  13  bulletins  were  issued  daily  by  the 

Control  Center  to  keep  personnel  informed  as  to  the  status  of  Apollo 
13  as  it  neared  launch. 

Countdown  monitoring:  Monitoring  activities  at  MSC  were  initiated 

at  T - 2 days  and  continued  through  the  mission.  Headquarters  personnel 
maintained  24-hour  monitoring  of  countdown  activities  at  KSC  up  until 
launch . 

Quality  data  review;  MSC  quality  personnel  at  KSC  reviewed  IDR's 
DR's,  etc.,  at  KSC  as  the  problems  occurred  to  assure  immediate  evalua- 
tion of  these  problems. 

Problem  review  and  evaluation:  Safety/R&QA  participated  in  review 

and  evaluation  of  hardware  problems  to  determine  potential  mission  im- 
pact. These  included  the  lunar  module  cryogenic  helium  tank  pressure 
rise  problem  and  the  oxygen  tank  umbilical  quick-disconnect  leakage 
occurrence . 

Launch  to  accident.  - 


Monitoring  activities:  Real-time  monitoring  of  Apollo  13  was 

maintained  at  MSC  and  in  the  GE  Mission  Evaluation  Room  offsite.  A 
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control  center  was  also  manned,  by  contractor  personnel  on  a 24-hour 
basis  to  provide  a central  focal  point  for  all  Safety/R&QA  missions 
activities. 

Daily  bulletins:  Bulletins  reporting  the  mission  status  were 

issued  daily. 

Flight  anomalies:  As  suspect  flight  anomalies  occurred,  they 

were  posted  in  the  Control  Center.  R&QA  personnel  were  requested  to 
review  and  evaluate  these  occurrences  as  soon  as  feasible  after  the 
events  were  reported. 

Requests  for  support:  Requests  for  R&QA  support  for  Test  Division 

or  other  NASA  groups  were  received  and  were  worked  as  required.  Three 
such  requests  were  received  prior  to  the  accident.  These  requests  were 
for  failure  histories,  failure  mode  evaluations,  etc.,  on  the  cryogenic 
helium  tank  pressure  rise  problem,  the  ECS  suit  pressure  transducer, 
and  on  the  oxygen  tank  no.  2 quantity  gaging  probe  problem. 

Postaccident .- 

Safety/R&QA  activities  immediately  following  the  Apollo  15  accident 
concentrated  on  compilation  of  subsystem  data  to  determine  the  factors 
involved  in  the  safe  return  of  the  crew — including  single  failure 
points.  It  included: 

Safe-return  factors:  Each  spacecraft  subsystem  was  reviewed  to 

identify  those  areas  and  concerns  affecting  the  safe  return  of  the 
crew  in  the  emergency  Apollo  13  configuration.  A "Safe  Return  Factors" 
book  was  compiled  and  made  available  for  reference  in  the  Planning 
Room  (GE). 

Quality  data:  The  quality  control  data  on  the  CSM  109  oxygen 

tank  no.  2 was  compiled  and  a search  of  these  records  for  any  question- 
able items  was  initiated. 

Historical  data:  The  historical  data,  including  failures,  on 

similar  oxygen  tanks  were  searched  for  evidence  of  significant  problem 
areas,  as  was  the  test  and  checkout  history  of  the  CSM  109  cryogenic 
and  EPS  systems. 

Flight  data  review  Safety/R&QA:  Personnel  participated  in  the 

review  of  flight  data  as  a part  of  a team. 

Configuration  review:  A review  of  the  equipment  and  its  relative 

location  in  bay  4 of  the  SM  was  made. 
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Single  failure  points:  A study  was  prepared  listing  all 

Criticality  I SFP's  in  both  the  CSM  and  the  LM  based  upon  the  emer- 
gency configuration  of  Apollo  13. 

Unexplained  anomalies:  A review  was  made  of  each  of  the  explained 

anomalies  approved  for  Apollo  13  to  determine  any  potential  connection 
with  the  Apollo  13  accident. 

Daily  review  meeting:  An  R&QA/Safety  Review  meeting  was  held 

daily  at  4 p.m.  c.s.t.  on  April  lU-17,  1970,  to  review  the  status  and 
progress  of  the  activities  listed  in  the  preceding  paragraphs.  The 
Manager,  Safety  and  R&QA,  strongly  emphasized  during  these  meetings 
the  need  to  concentrate  on  those  activities  affecting  the  safe  return 
■if  the  astronauts.  The  activities  designed  to  determine  the  cause  of 
the  accident  were  pursued  only  when  they  did  not  interfere  with  this 
primary  concern. 


CONCLUSION 


The  MSC  Safety/R&QA  plans  and  procedures  appear  to  be  adequate  and 
complete  for  their  assigned  responsibilities.  Their  maintenance  of 
equipment  and  system  records,  identification  of  suspect  and  failure 
areas,  and  followup  corrective  actions  through  the  Government  and  . 
contractor  organization  are  adequate.  Monitoring  of  contractors  is 
presently  accomplished  with  onsite  personnel  and  visits  rather  than 
by  formal  audits.  This  appears  adequate  at  present  but  should  be 
supplemented  by  formal  audit  visits  whenever  possible. 

The  preflight  System  Safety  Assessments  made  for  each  flight  of 
the  Apollo  Program  are  thorough  and  timely  and  the  flight  monitoring 
support  of  Safety/R&QA  is  good.  The  postflight  anomaly  identification 
and  tracking  system  is  good. 

The  Safety/R&QA  area  appears  to  be  generally  adequate  with 
proper  procedures,  good  organization,  and  well-motivated  personnel. 
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PART  E10 


SECURITY 


Security  surveys  were  conducted  at  Beech  Aircraft  Corporation, 
Boulder  Division,  and  North  American  Rockwell  Corporation,  Downey, 
California,  during  the  time  period  of  April  27,  1970,  through  May 
1970. 


The  purpose  of  these  investigations  was  to  evaluate  the  adequacy 
of  the  security  programs  at  each  location  during  the  time  periods  that 
the  Apollo  oxygen  tanks  were  in  custody  at  the  respective  industrial 
plants.  An  extension  of  the  accident  investigation  involved  recon- 
structing the  security  systems  and  procedures  applicable  to  the  oxygen 
tanks  from  the  time  of  shipment  from  NR  to  KSC  and  through  launch  of 
Apollo  13  on  April  11,  1970.  To  fulfill  the  stated  purpose  of  this 
inquiry  involved  evaluation  of  security  programs  at  Beech,  NR,  and  KSC 
from  April  1,.  1966,  through  April  11,  1970. 

The  security  programs  at  each  contractor  location  were  found  to  be 
satisfactory  and  adequate  to  provide  for  the  physical  protection  of  the 
oxygen  tanks.  The  security  procedures  provided  at  KSC  were  found  excel- 
lent and  assured  the  integrity  of  all  Apollo  13  hardware  from  initial 
receipt  on  June  26,  1969,  through  launch  on  April  11,  1970. 

Federal  and  local  agencies  acquainted  with  the  security  programs 
at  NR  and  Beech  were  contacted  and  gave  favorable  evaluations  of  each 
contractors  performance  during  the  pertinent  time  period. 

Industrial  security  files  were  reviewed  for  incidents  involving 
the  oxygen  tanks  at  Beech  and  spacecraft  106  and  109  at  NR.  The  results 
at  Beech  were  negative,  and  the  incidents  located  at  NR  have  been  re- 
ported for  technical  evaluation  in  the  preliminary  report  submitted 
May  8,  1970,  to  the  Review  Board  Chairman  and  Manager,  Apollo  Spacecraft 
Program  Office. 

The  determination  reached  as  the  result  of  this  survey  is  that  no 
evidence  was  discovered  that  the  failure  of  the  Apollo  13  oxygen  tanks 
was  the  result  of  any  willful, .deliberate,  or  malicious  act  on  the  part 
of  an  individual  at  the  contractor  facilities  surveyed  or  at  KSC.  Phys- 
ical security  measures  were  sufficiently  designed,  implemented,  and 
monitored  so  as  to  preclude  unauthorized  access  to  the  hardware  associ- 
ated with  this  investigation. 
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